diff --git a/dockerimg/dockerimg.go b/dockerimg/dockerimg.go
index 66fd691..ad18246 100644
--- a/dockerimg/dockerimg.go
+++ b/dockerimg/dockerimg.go
@@ -385,6 +385,16 @@
 		gitSrv.ps1URL.Store(&ps1URL)
 	}()
 
+	// Start automatic port tunneling if SSH is available
+	if sshAvailable {
+		go func() {
+			containerURL := "http://" + localAddr
+			tunnelManager := NewTunnelManager(containerURL, cntrName, 10) // Allow up to 10 concurrent tunnels
+			tunnelManager.Start(ctx)
+			slog.InfoContext(ctx, "Started automatic port tunnel manager", "container", cntrName)
+		}()
+	}
+
 	go func() {
 		cmd := exec.CommandContext(ctx, "docker", "attach", cntrName)
 		cmd.Stdin = os.Stdin
diff --git a/dockerimg/tunnel_manager.go b/dockerimg/tunnel_manager.go
new file mode 100644
index 0000000..6cd50ff
--- /dev/null
+++ b/dockerimg/tunnel_manager.go
@@ -0,0 +1,262 @@
+package dockerimg
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os/exec"
+	"sync"
+	"time"
+
+	"sketch.dev/loop"
+)
+
+// skipPorts defines system ports that should not be auto-tunneled
+var skipPorts = map[string]bool{
+	"22":  true, // SSH
+	"80":  true, // HTTP (this is the main sketch web interface)
+	"443": true, // HTTPS
+	"25":  true, // SMTP
+	"53":  true, // DNS
+	"110": true, // POP3
+	"143": true, // IMAP
+	"993": true, // IMAPS
+	"995": true, // POP3S
+}
+
+// TunnelManager manages automatic SSH tunnels for container ports
+type TunnelManager struct {
+	mu               sync.Mutex
+	containerURL     string                // HTTP URL to container (e.g., "http://localhost:8080")
+	containerSSHHost string                // SSH hostname for container (e.g., "sketch-abcd-efgh")
+	activeTunnels    map[string]*sshTunnel // port -> tunnel mapping
+	lastPollTime     time.Time
+	maxActiveTunnels int // maximum number of concurrent tunnels allowed
+}
+
+// sshTunnel represents an active SSH tunnel
+type sshTunnel struct {
+	containerPort string
+	hostPort      string
+	cmd           *exec.Cmd
+	cancel        context.CancelFunc
+}
+
+// NewTunnelManager creates a new tunnel manager
+func NewTunnelManager(containerURL, containerSSHHost string, maxActiveTunnels int) *TunnelManager {
+	return &TunnelManager{
+		containerURL:     containerURL,
+		containerSSHHost: containerSSHHost,
+		activeTunnels:    make(map[string]*sshTunnel),
+		lastPollTime:     time.Now(),
+		maxActiveTunnels: maxActiveTunnels,
+	}
+}
+
+// Start begins monitoring port events and managing tunnels
+func (tm *TunnelManager) Start(ctx context.Context) {
+	go func() {
+		ticker := time.NewTicker(10 * time.Second) // Poll every 10 seconds
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ctx.Done():
+				tm.cleanupAllTunnels()
+				return
+			case <-ticker.C:
+				tm.pollPortEvents(ctx)
+			}
+		}
+	}()
+}
+
+// pollPortEvents fetches recent port events from container and updates tunnels
+func (tm *TunnelManager) pollPortEvents(ctx context.Context) {
+	// Build URL with since parameter
+	url := fmt.Sprintf("%s/port-events?since=%s", tm.containerURL, tm.lastPollTime.Format(time.RFC3339))
+
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		slog.DebugContext(ctx, "Failed to create port events request", "error", err)
+		return
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		slog.DebugContext(ctx, "Failed to fetch port events", "error", err)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		slog.DebugContext(ctx, "Port events request failed", "status", resp.StatusCode)
+		return
+	}
+
+	var events []loop.PortEvent
+	if err := json.NewDecoder(resp.Body).Decode(&events); err != nil {
+		slog.DebugContext(ctx, "Failed to decode port events", "error", err)
+		return
+	}
+
+	// Process each event
+	for _, event := range events {
+		tm.processPortEvent(ctx, event)
+		tm.mu.Lock()
+		// Update last poll time to the latest event timestamp
+		if event.Timestamp.After(tm.lastPollTime) {
+			tm.lastPollTime = event.Timestamp
+		}
+		tm.mu.Unlock()
+	}
+
+	// Update poll time even if no events, to avoid re-fetching old events
+	if len(events) == 0 {
+		tm.lastPollTime = time.Now()
+	}
+}
+
+// processPortEvent handles a single port event
+func (tm *TunnelManager) processPortEvent(ctx context.Context, event loop.PortEvent) {
+	// Extract port number from event.Port (format: "tcp:0.0.0.0:8080")
+	containerPort := tm.extractPortNumber(event.Port)
+	if containerPort == "" {
+		slog.DebugContext(ctx, "Could not extract port number", "port", event.Port)
+		return
+	}
+
+	// Skip common system ports that we don't want to tunnel
+	if tm.shouldSkipPort(containerPort) {
+		slog.DebugContext(ctx, "Skipping system port", "port", containerPort)
+		return
+	}
+
+	switch event.Type {
+	case "opened":
+		tm.createTunnel(ctx, containerPort)
+	case "closed":
+		tm.removeTunnel(ctx, containerPort)
+	default:
+		slog.DebugContext(ctx, "Unknown port event type", "type", event.Type)
+	}
+}
+
+// extractPortNumber extracts port number from ss format like "tcp:0.0.0.0:8080"
+func (tm *TunnelManager) extractPortNumber(portStr string) string {
+	// Expected format: "tcp:0.0.0.0:8080" or "tcp:[::]:8080"
+	// Find the last colon and extract the port
+	for i := len(portStr) - 1; i >= 0; i-- {
+		if portStr[i] == ':' {
+			return portStr[i+1:]
+		}
+	}
+	return ""
+}
+
+// shouldSkipPort returns true for ports we don't want to auto-tunnel
+func (tm *TunnelManager) shouldSkipPort(port string) bool {
+	return skipPorts[port]
+}
+
+// createTunnel creates an SSH tunnel for the given container port
+func (tm *TunnelManager) createTunnel(ctx context.Context, containerPort string) {
+	tm.mu.Lock()
+	// Check if tunnel already exists
+	if _, exists := tm.activeTunnels[containerPort]; exists {
+		tm.mu.Unlock()
+		slog.DebugContext(ctx, "Tunnel already exists for port", "port", containerPort)
+		return
+	}
+
+	// Check if we've reached the maximum number of active tunnels
+	if len(tm.activeTunnels) >= tm.maxActiveTunnels {
+		tm.mu.Unlock()
+		slog.WarnContext(ctx, "Maximum active tunnels reached, skipping port", "port", containerPort, "max", tm.maxActiveTunnels, "active", len(tm.activeTunnels))
+		return
+	}
+	tm.mu.Unlock()
+
+	// Use the same port on host as container for simplicity
+	hostPort := containerPort
+
+	// Create SSH tunnel command: ssh -L hostPort:127.0.0.1:containerPort containerSSHHost
+	tunnelCtx, cancel := context.WithCancel(ctx)
+	cmd := exec.CommandContext(tunnelCtx, "ssh",
+		"-L", fmt.Sprintf("%s:127.0.0.1:%s", hostPort, containerPort),
+		"-N", // Don't execute remote commands
+		"-T", // Don't allocate TTY
+		tm.containerSSHHost,
+	)
+
+	// Start the tunnel
+	if err := cmd.Start(); err != nil {
+		slog.ErrorContext(ctx, "Failed to start SSH tunnel", "port", containerPort, "error", err)
+		cancel()
+		return
+	}
+
+	// Store tunnel info
+	tunnel := &sshTunnel{
+		containerPort: containerPort,
+		hostPort:      hostPort,
+		cmd:           cmd,
+		cancel:        cancel,
+	}
+	tm.mu.Lock()
+	tm.activeTunnels[containerPort] = tunnel
+	tm.mu.Unlock()
+
+	slog.InfoContext(ctx, "Created SSH tunnel", "container_port", containerPort, "host_port", hostPort)
+
+	// Monitor tunnel in background
+	go func() {
+		err := cmd.Wait()
+		tm.mu.Lock()
+		delete(tm.activeTunnels, containerPort)
+		tm.mu.Unlock()
+		if err != nil && tunnelCtx.Err() == nil {
+			slog.ErrorContext(ctx, "SSH tunnel exited with error", "port", containerPort, "error", err)
+		}
+	}()
+}
+
+// removeTunnel removes an SSH tunnel for the given container port
+func (tm *TunnelManager) removeTunnel(ctx context.Context, containerPort string) {
+	tunnel, exists := tm.activeTunnels[containerPort]
+	if !exists {
+		slog.DebugContext(ctx, "No tunnel to remove for port", "port", containerPort)
+		return
+	}
+
+	// Cancel the tunnel context and clean up
+	tunnel.cancel()
+	delete(tm.activeTunnels, containerPort)
+
+	slog.InfoContext(ctx, "Removed SSH tunnel", "container_port", containerPort, "host_port", tunnel.hostPort)
+}
+
+// cleanupAllTunnels stops all active tunnels
+func (tm *TunnelManager) cleanupAllTunnels() {
+	tm.mu.Lock()
+	defer tm.mu.Unlock()
+
+	for port, tunnel := range tm.activeTunnels {
+		tunnel.cancel()
+		delete(tm.activeTunnels, port)
+	}
+}
+
+// GetActiveTunnels returns a list of currently active tunnels
+func (tm *TunnelManager) GetActiveTunnels() map[string]string {
+	tm.mu.Lock()
+	defer tm.mu.Unlock()
+
+	result := make(map[string]string)
+	for containerPort, tunnel := range tm.activeTunnels {
+		result[containerPort] = tunnel.hostPort
+	}
+	return result
+}
diff --git a/dockerimg/tunnel_manager_test.go b/dockerimg/tunnel_manager_test.go
new file mode 100644
index 0000000..f430559
--- /dev/null
+++ b/dockerimg/tunnel_manager_test.go
@@ -0,0 +1,196 @@
+package dockerimg
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"sketch.dev/loop"
+)
+
+// TestTunnelManagerMaxLimit tests that the tunnel manager respects the max tunnels limit
+func TestTunnelManagerMaxLimit(t *testing.T) {
+	tm := NewTunnelManager("http://localhost:8080", "test-container", 2) // Max 2 tunnels
+
+	if tm.maxActiveTunnels != 2 {
+		t.Errorf("Expected maxActiveTunnels to be 2, got %d", tm.maxActiveTunnels)
+	}
+
+	// Test that GetActiveTunnels returns empty initially
+	activeTunnels := tm.GetActiveTunnels()
+	if len(activeTunnels) != 0 {
+		t.Errorf("Expected 0 active tunnels initially, got %d", len(activeTunnels))
+	}
+
+	// Simulate adding tunnels beyond the limit by directly manipulating the internal map
+	// This tests the limit logic without actually starting SSH processes
+	// Add 2 tunnels (up to the limit)
+	tm.activeTunnels["8080"] = &sshTunnel{containerPort: "8080", hostPort: "8080"}
+	tm.activeTunnels["9090"] = &sshTunnel{containerPort: "9090", hostPort: "9090"}
+
+	// Verify we have 2 active tunnels
+	activeTunnels = tm.GetActiveTunnels()
+	if len(activeTunnels) != 2 {
+		t.Errorf("Expected 2 active tunnels, got %d", len(activeTunnels))
+	}
+
+	// Now test that the limit check works - attempt to add a third tunnel
+	// Check if we've reached the maximum (this simulates the check in createTunnel)
+	shouldBlock := len(tm.activeTunnels) >= tm.maxActiveTunnels
+
+	if !shouldBlock {
+		t.Error("Expected tunnel creation to be blocked when at max limit, but limit check failed")
+	}
+
+	// Verify that attempting to add beyond the limit doesn't actually add more
+	if len(tm.activeTunnels) < tm.maxActiveTunnels {
+		// This should not happen since we're at the limit
+		tm.activeTunnels["3000"] = &sshTunnel{containerPort: "3000", hostPort: "3000"}
+	}
+
+	// Verify we still have only 2 active tunnels (didn't exceed limit)
+	activeTunnels = tm.GetActiveTunnels()
+	if len(activeTunnels) != 2 {
+		t.Errorf("Expected exactly 2 active tunnels after limit enforcement, got %d", len(activeTunnels))
+	}
+}
+
+// TestNewTunnelManagerParams tests that NewTunnelManager correctly sets all parameters
+func TestNewTunnelManagerParams(t *testing.T) {
+	containerURL := "http://localhost:9090"
+	containerSSHHost := "test-ssh-host"
+	maxTunnels := 5
+
+	tm := NewTunnelManager(containerURL, containerSSHHost, maxTunnels)
+
+	if tm.containerURL != containerURL {
+		t.Errorf("Expected containerURL %s, got %s", containerURL, tm.containerURL)
+	}
+	if tm.containerSSHHost != containerSSHHost {
+		t.Errorf("Expected containerSSHHost %s, got %s", containerSSHHost, tm.containerSSHHost)
+	}
+	if tm.maxActiveTunnels != maxTunnels {
+		t.Errorf("Expected maxActiveTunnels %d, got %d", maxTunnels, tm.maxActiveTunnels)
+	}
+	if tm.activeTunnels == nil {
+		t.Error("Expected activeTunnels map to be initialized")
+	}
+	if tm.lastPollTime.IsZero() {
+		t.Error("Expected lastPollTime to be initialized")
+	}
+}
+
+// TestShouldSkipPort tests the port skipping logic
+func TestShouldSkipPort(t *testing.T) {
+	tm := NewTunnelManager("http://localhost:8080", "test-container", 10)
+
+	// Test that system ports are skipped
+	systemPorts := []string{"22", "80", "443", "25", "53"}
+	for _, port := range systemPorts {
+		if !tm.shouldSkipPort(port) {
+			t.Errorf("Expected port %s to be skipped", port)
+		}
+	}
+
+	// Test that application ports are not skipped
+	appPorts := []string{"8080", "3000", "9090", "8000"}
+	for _, port := range appPorts {
+		if tm.shouldSkipPort(port) {
+			t.Errorf("Expected port %s to NOT be skipped", port)
+		}
+	}
+}
+
+// TestExtractPortNumber tests port number extraction from ss format
+func TestExtractPortNumber(t *testing.T) {
+	tm := NewTunnelManager("http://localhost:8080", "test-container", 10)
+
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"tcp:0.0.0.0:8080", "8080"},
+		{"tcp:127.0.0.1:3000", "3000"},
+		{"tcp:[::]:9090", "9090"},
+		{"udp:0.0.0.0:53", "53"},
+		{"invalid", ""},
+		{"", ""},
+	}
+
+	for _, test := range tests {
+		result := tm.extractPortNumber(test.input)
+		if result != test.expected {
+			t.Errorf("extractPortNumber(%q) = %q, expected %q", test.input, result, test.expected)
+		}
+	}
+}
+
+// TestTunnelManagerLimitEnforcement tests that createTunnel enforces the max limit
+func TestTunnelManagerLimitEnforcement(t *testing.T) {
+	tm := NewTunnelManager("http://localhost:8080", "test-container", 2) // Max 2 tunnels
+	ctx := context.Background()
+
+	// Add tunnels manually to reach the limit (simulating successful SSH setup)
+	// In real usage, these would be added by createTunnel after successful SSH
+	tm.activeTunnels["8080"] = &sshTunnel{containerPort: "8080", hostPort: "8080"}
+	tm.activeTunnels["9090"] = &sshTunnel{containerPort: "9090", hostPort: "9090"}
+
+	// Verify we're now at the limit
+	if len(tm.GetActiveTunnels()) != 2 {
+		t.Fatalf("Setup failed: expected 2 active tunnels, got %d", len(tm.GetActiveTunnels()))
+	}
+
+	// Now test that createTunnel respects the limit by calling it directly
+	// This should hit the limit check and return early without attempting SSH
+	tm.createTunnel(ctx, "3000")
+	tm.createTunnel(ctx, "4000")
+
+	// Verify no additional tunnels were added (limit enforcement worked)
+	if len(tm.GetActiveTunnels()) != 2 {
+		t.Errorf("createTunnel should have been blocked by limit, but tunnel count changed from 2 to %d", len(tm.GetActiveTunnels()))
+	}
+
+	// Verify we're at the limit
+	if len(tm.GetActiveTunnels()) != 2 {
+		t.Fatalf("Expected 2 active tunnels, got %d", len(tm.GetActiveTunnels()))
+	}
+
+	// Now try to process more port events that would create additional tunnels
+	// These should be blocked by the limit check in createTunnel
+	portEvent1 := loop.PortEvent{
+		Type:      "opened",
+		Port:      "tcp:0.0.0.0:3000",
+		Timestamp: time.Now(),
+	}
+	portEvent2 := loop.PortEvent{
+		Type:      "opened",
+		Port:      "tcp:0.0.0.0:4000",
+		Timestamp: time.Now(),
+	}
+
+	// Process these events - they should be blocked by the limit
+	tm.processPortEvent(ctx, portEvent1)
+	tm.processPortEvent(ctx, portEvent2)
+
+	// Verify that no additional tunnels were created
+	activeTunnels := tm.GetActiveTunnels()
+	if len(activeTunnels) != 2 {
+		t.Errorf("Expected exactly 2 active tunnels after limit enforcement, got %d", len(activeTunnels))
+	}
+
+	// Verify the original tunnels are still there
+	if _, exists := activeTunnels["8080"]; !exists {
+		t.Error("Expected original tunnel for port 8080 to still exist")
+	}
+	if _, exists := activeTunnels["9090"]; !exists {
+		t.Error("Expected original tunnel for port 9090 to still exist")
+	}
+
+	// Verify the new tunnels were NOT created
+	if _, exists := activeTunnels["3000"]; exists {
+		t.Error("Expected tunnel for port 3000 to NOT be created due to limit")
+	}
+	if _, exists := activeTunnels["4000"]; exists {
+		t.Error("Expected tunnel for port 4000 to NOT be created due to limit")
+	}
+}
diff --git a/loop/agent.go b/loop/agent.go
index c4cbd05..4a27ab0 100644
--- a/loop/agent.go
+++ b/loop/agent.go
@@ -143,6 +143,8 @@
 	// CompactConversation compacts the current conversation by generating a summary
 	// and restarting the conversation with that summary as the initial context
 	CompactConversation(ctx context.Context) error
+	// GetPortMonitor returns the port monitor instance for accessing port events
+	GetPortMonitor() *PortMonitor
 }
 
 type CodingAgentMessageType string
@@ -2337,3 +2339,8 @@
 
 	return nil
 }
+
+// GetPortMonitor returns the port monitor instance for accessing port events
+func (a *Agent) GetPortMonitor() *PortMonitor {
+	return a.portMonitor
+}
diff --git a/loop/port_monitor.go b/loop/port_monitor.go
index 514e928..9614db2 100644
--- a/loop/port_monitor.go
+++ b/loop/port_monitor.go
@@ -10,15 +10,27 @@
 	"time"
 )
 
+// PortEvent represents a port change event
+type PortEvent struct {
+	Type      string    `json:"type"`      // "opened" or "closed"
+	Port      string    `json:"port"`      // "proto:address:port" format
+	Timestamp time.Time `json:"timestamp"` // when the event occurred
+}
+
 // PortMonitor handles periodic monitoring of listening ports in containers
 type PortMonitor struct {
-	mu        sync.Mutex // protects following
-	lastPorts string     // last netstat/ss output for comparison
+	mu        sync.Mutex  // protects following
+	lastPorts string      // last netstat/ss output for comparison
+	events    []PortEvent // circular buffer of recent port events
+	maxEvents int         // maximum events to keep in buffer
 }
 
 // NewPortMonitor creates a new PortMonitor instance
 func NewPortMonitor() *PortMonitor {
-	return &PortMonitor{}
+	return &PortMonitor{
+		maxEvents: 100, // keep last 100 events
+		events:    make([]PortEvent, 0, 100),
+	}
 }
 
 // Start begins periodic port monitoring in a background goroutine
@@ -74,11 +86,17 @@
 func (pm *PortMonitor) logPortDifferences(ctx context.Context, oldPorts, newPorts string) {
 	oldPortSet := parseSSPorts(oldPorts)
 	newPortSet := parseSSPorts(newPorts)
+	now := time.Now()
 
 	// Find newly opened ports
 	for port := range newPortSet {
 		if !oldPortSet[port] {
 			slog.InfoContext(ctx, "New port detected", slog.String("port", port))
+			pm.addEvent(PortEvent{
+				Type:      "opened",
+				Port:      port,
+				Timestamp: now,
+			})
 		}
 	}
 
@@ -86,10 +104,53 @@
 	for port := range oldPortSet {
 		if !newPortSet[port] {
 			slog.InfoContext(ctx, "Port closed", slog.String("port", port))
+			pm.addEvent(PortEvent{
+				Type:      "closed",
+				Port:      port,
+				Timestamp: now,
+			})
 		}
 	}
 }
 
+// addEvent adds a port event to the circular buffer (must be called with mutex held)
+func (pm *PortMonitor) addEvent(event PortEvent) {
+	// If buffer is full, remove oldest event
+	if len(pm.events) >= pm.maxEvents {
+		// Shift all events left by 1 to remove oldest
+		copy(pm.events, pm.events[1:])
+		pm.events = pm.events[:len(pm.events)-1]
+	}
+	// Add new event
+	pm.events = append(pm.events, event)
+}
+
+// GetRecentEvents returns a copy of recent port events since the given timestamp
+func (pm *PortMonitor) GetRecentEvents(since time.Time) []PortEvent {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	// Find events since the given timestamp
+	var result []PortEvent
+	for _, event := range pm.events {
+		if event.Timestamp.After(since) {
+			result = append(result, event)
+		}
+	}
+	return result
+}
+
+// GetAllRecentEvents returns a copy of all recent port events
+func (pm *PortMonitor) GetAllRecentEvents() []PortEvent {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	// Return a copy of all events
+	result := make([]PortEvent, len(pm.events))
+	copy(result, pm.events)
+	return result
+}
+
 // parseSSPorts extracts listening ports from ss -lntu output
 // Returns a map with "proto:address:port" as keys
 // ss output format: Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
diff --git a/loop/port_monitor_test.go b/loop/port_monitor_test.go
index 8f474e0..a1dad57 100644
--- a/loop/port_monitor_test.go
+++ b/loop/port_monitor_test.go
@@ -3,6 +3,7 @@
 import (
 	"context"
 	"testing"
+	"time"
 )
 
 // TestPortMonitoring tests the port monitoring functionality
@@ -131,3 +132,74 @@
 		})
 	}
 }
+
+// TestPortEventStorage tests the new event storage functionality
+func TestPortEventStorage(t *testing.T) {
+	pm := NewPortMonitor()
+
+	// Initially should have no events
+	allEvents := pm.GetAllRecentEvents()
+	if len(allEvents) != 0 {
+		t.Errorf("Expected 0 events initially, got %d", len(allEvents))
+	}
+
+	// Simulate port changes that would add events
+	ctx := context.Background()
+	oldPorts := "Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\ntcp   LISTEN 0      128    0.0.0.0:8080         0.0.0.0:*"
+	newPorts := "Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\ntcp   LISTEN 0      128    0.0.0.0:9090         0.0.0.0:*"
+
+	pm.logPortDifferences(ctx, oldPorts, newPorts)
+
+	// Should now have events
+	allEvents = pm.GetAllRecentEvents()
+	if len(allEvents) != 2 {
+		t.Errorf("Expected 2 events (1 opened, 1 closed), got %d", len(allEvents))
+	}
+
+	// Check event types
+	foundOpened := false
+	foundClosed := false
+	for _, event := range allEvents {
+		if event.Type == "opened" && event.Port == "tcp:0.0.0.0:9090" {
+			foundOpened = true
+		}
+		if event.Type == "closed" && event.Port == "tcp:0.0.0.0:8080" {
+			foundClosed = true
+		}
+	}
+
+	if !foundOpened {
+		t.Error("Expected to find 'opened' event for port tcp:0.0.0.0:9090")
+	}
+	if !foundClosed {
+		t.Error("Expected to find 'closed' event for port tcp:0.0.0.0:8080")
+	}
+}
+
+// TestPortEventFiltering tests the time-based filtering
+func TestPortEventFiltering(t *testing.T) {
+	pm := NewPortMonitor()
+	ctx := context.Background()
+
+	// Record time before adding events
+	beforeTime := time.Now()
+	time.Sleep(1 * time.Millisecond) // Small delay to ensure timestamp difference
+
+	// Add some events
+	oldPorts := "Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\ntcp   LISTEN 0      128    0.0.0.0:8080         0.0.0.0:*"
+	newPorts := "Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port\ntcp   LISTEN 0      128    0.0.0.0:9090         0.0.0.0:*"
+	pm.logPortDifferences(ctx, oldPorts, newPorts)
+
+	// Get events since beforeTime - should get all events
+	recentEvents := pm.GetRecentEvents(beforeTime)
+	if len(recentEvents) != 2 {
+		t.Errorf("Expected 2 recent events, got %d", len(recentEvents))
+	}
+
+	// Get events since now - should get no events
+	nowTime := time.Now()
+	recentEvents = pm.GetRecentEvents(nowTime)
+	if len(recentEvents) != 0 {
+		t.Errorf("Expected 0 recent events since now, got %d", len(recentEvents))
+	}
+}
diff --git a/loop/server/loophttp.go b/loop/server/loophttp.go
index 53776aa..784d20b 100644
--- a/loop/server/loophttp.go
+++ b/loop/server/loophttp.go
@@ -242,6 +242,44 @@
 		io.WriteString(w, "{}\n")
 	})
 
+	// Handler for /port-events - returns recent port change events
+	s.mux.HandleFunc("/port-events", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+
+		// Get the 'since' query parameter for filtering events
+		sinceParam := r.URL.Query().Get("since")
+		var events []loop.PortEvent
+
+		// Get port monitor from agent
+		portMonitor := agent.GetPortMonitor()
+		if portMonitor == nil {
+			// Return empty array if port monitor not available
+			events = []loop.PortEvent{}
+		} else if sinceParam != "" {
+			// Parse the since timestamp
+			sinceTime, err := time.Parse(time.RFC3339, sinceParam)
+			if err != nil {
+				http.Error(w, fmt.Sprintf("Invalid 'since' timestamp format: %v", err), http.StatusBadRequest)
+				return
+			}
+			events = portMonitor.GetRecentEvents(sinceTime)
+		} else {
+			// Return all recent events
+			events = portMonitor.GetAllRecentEvents()
+		}
+
+		// Encode and return the events
+		if err := json.NewEncoder(w).Encode(events); err != nil {
+			slog.ErrorContext(r.Context(), "Error encoding port events response", slog.Any("err", err))
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+	})
+
 	// Handler for /messages?start=N&end=M (start/end are optional)
 	s.mux.HandleFunc("/messages", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
diff --git a/loop/server/loophttp_test.go b/loop/server/loophttp_test.go
index d755717..a6dab62 100644
--- a/loop/server/loophttp_test.go
+++ b/loop/server/loophttp_test.go
@@ -3,6 +3,7 @@
 import (
 	"bufio"
 	"context"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"slices"
@@ -249,6 +250,7 @@
 func (m *mockAgent) DetectGitChanges(ctx context.Context) error { return nil }
 func (m *mockAgent) GetEndFeedback() *loop.EndFeedback          { return m.endFeedback }
 func (m *mockAgent) SetEndFeedback(feedback *loop.EndFeedback)  { m.endFeedback = feedback }
+func (m *mockAgent) GetPortMonitor() *loop.PortMonitor          { return loop.NewPortMonitor() }
 
 // TestEndFeedback tests the end session feedback functionality
 func TestEndFeedback(t *testing.T) {
@@ -551,3 +553,69 @@
 	// No HTTP endpoint to test anymore - compaction is done via /compact message
 	t.Log("Mock CompactConversation works correctly")
 }
+
+// TestPortEventsEndpoint tests the /port-events HTTP endpoint
+func TestPortEventsEndpoint(t *testing.T) {
+	// Create a mock agent that implements the CodingAgent interface
+	agent := &mockAgent{}
+
+	// Create a server with the mock agent
+	server, err := server.New(agent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Test GET /port-events
+	req, err := http.NewRequest("GET", "/port-events", nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+
+	// Should return 200 OK
+	if status := rr.Code; status != http.StatusOK {
+		t.Errorf("Expected status code %d, got %d", http.StatusOK, status)
+	}
+
+	// Should return JSON content type
+	contentType := rr.Header().Get("Content-Type")
+	if contentType != "application/json" {
+		t.Errorf("Expected Content-Type application/json, got %s", contentType)
+	}
+
+	// Should return valid JSON (empty array since mock returns no events)
+	var events []any
+	if err := json.Unmarshal(rr.Body.Bytes(), &events); err != nil {
+		t.Errorf("Failed to parse JSON response: %v", err)
+	}
+
+	// Should be empty array for mock agent
+	if len(events) != 0 {
+		t.Errorf("Expected empty events array, got %d events", len(events))
+	}
+}
+
+// TestPortEventsEndpointMethodNotAllowed tests that non-GET requests are rejected
+func TestPortEventsEndpointMethodNotAllowed(t *testing.T) {
+	agent := &mockAgent{}
+	server, err := server.New(agent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Test POST /port-events (should be rejected)
+	req, err := http.NewRequest("POST", "/port-events", nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+
+	// Should return 405 Method Not Allowed
+	if status := rr.Code; status != http.StatusMethodNotAllowed {
+		t.Errorf("Expected status code %d, got %d", http.StatusMethodNotAllowed, status)
+	}
+}