@andypai/agent-kanban 0.7.0 → 0.8.0

package/src/__tests__/index.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { ErrorCode, KanbanError, type ErrorCodeValue } from '../errors'
 import type { Task, TaskComment } from '../types'
-import { parseMcpArgs, parseServeArgs, run } from '../index'
+import { assertTunnelSecurity, parseMcpArgs, parseServeArgs, run } from '../index'
 
 async function withTempDb(runTest: (dbPath: string) => Promise<void>): Promise<void> {
   const dir = mkdtempSync(join(tmpdir(), 'kanban-run-'))
@@ -85,12 +85,38 @@ describe('parseServeArgs', () => {
     })
   })
 
-  test('--sync-interval-ms rejects invalid values', () => {
-    for (const raw of ['999', '0']) {
+  test('--sync-interval-ms rejects below-minimum and overflow values as INVALID_ARGUMENT', () => {
+    // The whole flag family reports rejections with one code: a digit-but-too-small
+    // value, a value past MAX_SAFE_INTEGER (silent precision loss), OR a digit
+    // string so long that Number() overflows to Infinity — all INVALID_ARGUMENT.
+    for (const raw of ['999', '0', '9007199254740993', '9'.repeat(309)]) {
       expect(() => parseServeArgs(['serve', '--sync-interval-ms', raw])).toThrow(KanbanError)
+      try {
+        parseServeArgs(['serve', '--sync-interval-ms', raw])
+      } catch (err) {
+        expect((err as KanbanError).code).toBe(ErrorCode.INVALID_ARGUMENT)
+      }
     }
   })
 
+  test('D7: --sync-interval-ms rejects non-digit notation (hex/scientific/garbage/empty)', () => {
+    for (const bad of ['0x1000', '1e3', '1_000', '3.5', 'abc', '-1000']) {
+      expect(() => parseServeArgs(['serve', `--sync-interval-ms=${bad}`])).toThrow(KanbanError)
+      try {
+        parseServeArgs(['serve', `--sync-interval-ms=${bad}`])
+      } catch (err) {
+        expect((err as KanbanError).code).toBe(ErrorCode.INVALID_ARGUMENT)
+      }
+    }
+    // explicit empty is rejected rather than silently falling back to the default
+    expect(() => parseServeArgs(['serve', '--sync-interval-ms='])).toThrow(KanbanError)
+  })
+
+  test('D7: --sync-interval-ms accepts a plain integer >= 1000', () => {
+    expect(parseServeArgs(['serve', '--sync-interval-ms=1000']).syncIntervalMs).toBe(1000)
+    expect(parseServeArgs(['serve', '--sync-interval-ms=600000']).syncIntervalMs).toBe(600000)
+  })
+
   test('--token / --allowed-origin flags and env are parsed; flags win over env', () => {
     const prevToken = process.env['KANBAN_API_TOKEN']
     const prevOrigin = process.env['KANBAN_ALLOWED_ORIGIN']
@@ -129,6 +155,84 @@ describe('parseServeArgs', () => {
       expect((err as KanbanError).code).toBe(ErrorCode.INVALID_ARGUMENT)
     }
   })
+
+  test('D6: rejects non-integer / out-of-range / trailing-garbage ports', () => {
+    for (const bad of ['abc', '123abc', '-1', '70000', '3.5', '0x10', '']) {
+      expect(() => parseServeArgs(['serve', `--port=${bad}`])).toThrow(KanbanError)
+      try {
+        parseServeArgs(['serve', `--port=${bad}`])
+      } catch (err) {
+        expect((err as KanbanError).code).toBe(ErrorCode.INVALID_ARGUMENT)
+      }
+    }
+  })
+
+  test('D6: accepts valid ports including 0 (OS-assigned ephemeral)', () => {
+    expect(parseServeArgs(['serve', '--port=0']).port).toBe(0)
+    expect(parseServeArgs(['serve', '--port=8080']).port).toBe(8080)
+    expect(parseServeArgs(['serve', '--port=65535']).port).toBe(65535)
+  })
+
+  test('D6: an invalid PORT env value is rejected too', () => {
+    const prev = process.env['PORT']
+    process.env['PORT'] = 'not-a-port'
+    try {
+      expect(() => parseServeArgs(['serve'])).toThrow(KanbanError)
+    } finally {
+      if (prev === undefined) delete process.env['PORT']
+      else process.env['PORT'] = prev
+    }
+  })
+})
+
+describe('assertTunnelSecurity (F44 + D5)', () => {
+  test('no tunnel: always allowed regardless of token/secret', () => {
+    expect(() => assertTunnelSecurity({ tunnel: false }, {})).not.toThrow()
+  })
+
+  test('F44: tunnel without an API token is refused', () => {
+    expect(() => assertTunnelSecurity({ tunnel: true }, {})).toThrow(KanbanError)
+    try {
+      assertTunnelSecurity({ tunnel: true }, {})
+    } catch (err) {
+      expect((err as KanbanError).message).toContain('without an API token')
+    }
+  })
+
+  test('tunnel + token on the local provider is allowed (local has no webhooks)', () => {
+    expect(() =>
+      assertTunnelSecurity({ tunnel: true, authToken: 't' }, { KANBAN_PROVIDER: 'local' }),
+    ).not.toThrow()
+    // default provider is local when KANBAN_PROVIDER is unset
+    expect(() => assertTunnelSecurity({ tunnel: true, authToken: 't' }, {})).not.toThrow()
+  })
+
+  test('D5: tunnel + token on jira without JIRA_WEBHOOK_SECRET is refused', () => {
+    try {
+      assertTunnelSecurity({ tunnel: true, authToken: 't' }, { KANBAN_PROVIDER: 'jira' })
+      throw new Error('expected refusal')
+    } catch (err) {
+      expect((err as KanbanError).message).toContain('JIRA_WEBHOOK_SECRET')
+    }
+  })
+
+  test('D5: tunnel + token on jira WITH the secret is allowed', () => {
+    expect(() =>
+      assertTunnelSecurity(
+        { tunnel: true, authToken: 't' },
+        { KANBAN_PROVIDER: 'jira', JIRA_WEBHOOK_SECRET: 's' },
+      ),
+    ).not.toThrow()
+  })
+
+  test('D5: tunnel + token on linear without LINEAR_WEBHOOK_SECRET is refused', () => {
+    try {
+      assertTunnelSecurity({ tunnel: true, authToken: 't' }, { KANBAN_PROVIDER: 'Linear' })
+      throw new Error('expected refusal')
+    } catch (err) {
+      expect((err as KanbanError).message).toContain('LINEAR_WEBHOOK_SECRET')
+    }
+  })
 })
 
 describe('parseMcpArgs', () => {

package/src/__tests__/jira-wiring.test.ts

@@ -132,14 +132,37 @@ describe('jira-wiring', () => {
     expect(provider.type).toBe('jira')
   })
 
-  test('JIRA_BOARD_ID non-numeric falls back to undefined in env loader', () => {
+  test('JIRA_BOARD_ID unset omits boardId (no board pinned)', () => {
     setJiraRequiredEnv()
-    process.env['JIRA_BOARD_ID'] = 'notanumber'
     const config = trackerConfigFromEnv()
     expect(config.provider).toBe('jira')
     expect(config).not.toHaveProperty('boardId')
   })
 
+  test('JIRA_BOARD_ID accepts a plain positive integer', () => {
+    setJiraRequiredEnv()
+    process.env['JIRA_BOARD_ID'] = '  42  '
+    const config = trackerConfigFromEnv()
+    expect(config.provider).toBe('jira')
+    expect((config as { boardId?: number }).boardId).toBe(42)
+  })
+
+  test('JIRA_BOARD_ID rejects malformed values as INVALID_CONFIG (no silent wrong board)', () => {
+    setJiraRequiredEnv()
+    // Number.parseInt would have quietly coerced these to 12 / 1 / -5 / 0 and
+    // pinned a wrong board; they must now be rejected.
+    for (const raw of ['notanumber', '12abc', '1e3', '0x10', '3.5', '-5', '0']) {
+      process.env['JIRA_BOARD_ID'] = raw
+      let code: string | undefined
+      try {
+        trackerConfigFromEnv()
+      } catch (err) {
+        code = (err as KanbanError).code
+      }
+      expect(code).toBe(ErrorCode.INVALID_CONFIG)
+    }
+  })
+
   test('trackerConfigFromEnv carries remote polling sync interval', () => {
     setJiraRequiredEnv()
     process.env['KANBAN_SYNC_INTERVAL_MS'] = '60000'

package/src/__tests__/server.test.ts

@@ -370,6 +370,84 @@ describe('startServer auth + CORS', () => {
     expect(res.status).not.toBe(401)
   })
 
+  test('a throwing provider webhook handler returns an enveloped 500, not a dropped connection', async () => {
+    const runtime = startServer(
+      makeProvider({
+        type: 'local',
+        async handleWebhook() {
+          throw new Error('boom during webhook apply')
+        },
+      }),
+      0,
+      { authToken: TOKEN },
+    )
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/webhooks/local`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+    const body = (await res.json()) as { ok: boolean; error: { code: string } }
+    expect(res.status).toBe(500)
+    expect(body.ok).toBe(false)
+    expect(body.error.code).toBe('INTERNAL_ERROR')
+  })
+
+  test('F06: a `/kanban`-prefixed API path still enforces the auth gate (no prefix bypass)', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+
+    const noAuth = await fetch(`http://127.0.0.1:${runtime.port}/kanban/api/bootstrap`)
+    expect(noAuth.status).toBe(401)
+
+    const withAuth = await fetch(`http://127.0.0.1:${runtime.port}/kanban/api/bootstrap`, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    })
+    expect(withAuth.status).toBe(200)
+
+    // Health stays public under the prefix too.
+    const health = await fetch(`http://127.0.0.1:${runtime.port}/kanban/api/health`)
+    expect(health.status).toBe(200)
+  })
+
+  test('F13: a connected WS client receives task:upsert when a task is created via the API', async () => {
+    const runtime = startServer(makeProvider(), 0)
+    runtimes.push(runtime)
+
+    const ws = new WebSocket(`ws://127.0.0.1:${runtime.port}/ws`)
+    await new Promise<void>((resolve, reject) => {
+      ws.onopen = () => resolve()
+      ws.onerror = () => reject(new Error('ws connection failed'))
+    })
+    const received = new Promise<{
+      type: string
+      task?: { column_id?: string }
+      columnId?: string
+    }>((resolve, reject) => {
+      ws.onmessage = (e) => resolve(JSON.parse(String(e.data)))
+      // Fast-fail with a clear message instead of hanging until the global test
+      // timeout if the broadcast never arrives (e.g. the socket was not yet
+      // registered when the mutation fired).
+      setTimeout(() => reject(new Error('timed out waiting for ws broadcast')), 4000)
+    })
+    try {
+      // Let the open handler register the socket before the mutation broadcasts.
+      await sleep(25)
+
+      await fetch(`http://127.0.0.1:${runtime.port}/api/tasks`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Broadcast me' }),
+      })
+
+      const msg = await received
+      expect(msg.type).toBe('task:upsert')
+      expect(msg.columnId).toBe('backlog')
+    } finally {
+      ws.close()
+    }
+  })
+
   test('wsClients are tracked per server instance, not shared globally', async () => {
     const a = startServer(makeProvider(), 0)
     runtimes.push(a)

package/src/__tests__/sync-config.test.ts

@@ -17,7 +17,20 @@ describe('sync config', () => {
   })
 
   test('rejects invalid or too-aggressive intervals', () => {
-    for (const raw of ['999', '5s', '1000.5', '0']) {
+    // OBS-1: digits-only — hex/scientific notation (which Number() would accept)
+    // and over-long digit strings (precision loss / Infinity) are now rejected
+    // for the env var too, matching the strict --sync-interval-ms CLI flag.
+    for (const raw of [
+      '999',
+      '5s',
+      '1000.5',
+      '0',
+      '0x3e8',
+      '1e3',
+      '1_000',
+      '9007199254740993',
+      '9'.repeat(309),
+    ]) {
       let err: unknown
       try {
         resolvePollingSyncIntervalMs(raw)

package/src/__tests__/tracker-config-webhook-secret.test.ts

@@ -0,0 +1,89 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  WEBHOOK_SECRET_ENV,
+  trackerProviderFromEnv,
+  webhookSecretFromEnv,
+  type TrackerProvider,
+} from '../tracker-config'
+
+// OBS-2: the provider -> webhook-secret-env mapping is a single source of truth.
+// WEBHOOK_SECRET_ENV is typed Record<TrackerProvider, …>, so adding a new
+// provider to the union is a COMPILE error until its secret env is declared here
+// — that compile-time exhaustiveness is the real guard against assertTunnelSecurity
+// silently failing open for a new webhook-capable provider. These runtime tests
+// pin the map contents and the env normalization the guard relies on.
+
+describe('WEBHOOK_SECRET_ENV (single source of truth)', () => {
+  test('maps each known provider to its secret env (local has none)', () => {
+    expect(WEBHOOK_SECRET_ENV).toEqual({
+      local: null,
+      linear: 'LINEAR_WEBHOOK_SECRET',
+      jira: 'JIRA_WEBHOOK_SECRET',
+    })
+  })
+
+  test('every non-local provider points at a *_WEBHOOK_SECRET env name', () => {
+    for (const [provider, envName] of Object.entries(WEBHOOK_SECRET_ENV)) {
+      if (provider === 'local') {
+        expect(envName).toBeNull()
+      } else {
+        expect(envName).toMatch(/_WEBHOOK_SECRET$/)
+      }
+    }
+  })
+})
+
+describe('trackerProviderFromEnv', () => {
+  test('normalizes known providers (case/whitespace-insensitive)', () => {
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: 'jira' })).toBe('jira')
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: 'Linear' })).toBe('linear')
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: '  JIRA  ' })).toBe('jira')
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: 'local' })).toBe('local')
+  })
+
+  test('falls back to local for unset / blank / unrecognized values', () => {
+    expect(trackerProviderFromEnv({})).toBe('local')
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: '' })).toBe('local')
+    // A future provider not yet wired in resolves to local (no webhooks) rather
+    // than an unmapped value; once added to TrackerProvider it must gain a
+    // WEBHOOK_SECRET_ENV entry (compile-enforced).
+    expect(trackerProviderFromEnv({ KANBAN_PROVIDER: 'github' })).toBe('local')
+  })
+
+  test('inherited Object property names do not leak through the map lookup', () => {
+    // The normalizer derives from WEBHOOK_SECRET_ENV's OWN keys, so prototype
+    // names must not be treated as providers.
+    for (const name of ['constructor', 'toString', 'hasOwnProperty', '__proto__']) {
+      expect(trackerProviderFromEnv({ KANBAN_PROVIDER: name })).toBe('local')
+    }
+  })
+})
+
+describe('webhookSecretFromEnv', () => {
+  // The runtime signature enforcement in jira-core/linear-core resolves its secret
+  // through this helper, and the assertTunnelSecurity tunnel gate resolves the same
+  // env name through WEBHOOK_SECRET_ENV. These tests pin that they read the SAME env
+  // name, so the gate and enforcement can't drift into a fail-open.
+  test('reads exactly the env name WEBHOOK_SECRET_ENV declares for each provider', () => {
+    for (const [provider, envName] of Object.entries(WEBHOOK_SECRET_ENV)) {
+      if (envName === null) continue
+      const secret = `secret-for-${envName}`
+      expect(webhookSecretFromEnv(provider as TrackerProvider, { [envName]: secret })).toBe(secret)
+    }
+  })
+
+  test('returns undefined when the declared secret env is unset (open dev mode)', () => {
+    expect(webhookSecretFromEnv('jira', {})).toBeUndefined()
+    expect(webhookSecretFromEnv('linear', {})).toBeUndefined()
+  })
+
+  test('local has no webhook secret env, so it never resolves a secret', () => {
+    expect(webhookSecretFromEnv('local', { JIRA_WEBHOOK_SECRET: 'x' })).toBeUndefined()
+  })
+
+  test('does not read a different env than the one the provider declares', () => {
+    // Setting Linear's secret must not satisfy Jira's lookup, and vice versa.
+    expect(webhookSecretFromEnv('jira', { LINEAR_WEBHOOK_SECRET: 'l' })).toBeUndefined()
+    expect(webhookSecretFromEnv('linear', { JIRA_WEBHOOK_SECRET: 'j' })).toBeUndefined()
+  })
+})

package/src/__tests__/transport-input.test.ts

@@ -1,5 +1,71 @@
 import { describe, expect, test } from 'bun:test'
-import { parsePositiveInt } from '../transport-input'
+import { ErrorCode, KanbanError } from '../errors'
+import { parseBoundedInt, parseDecimalDigits, parsePositiveInt } from '../transport-input'
+
+describe('parseDecimalDigits', () => {
+  test('parses plain decimal digit strings (whitespace-trimmed)', () => {
+    expect(parseDecimalDigits('0')).toBe(0)
+    expect(parseDecimalDigits('42')).toBe(42)
+    expect(parseDecimalDigits('  1000  ')).toBe(1000)
+    expect(parseDecimalDigits(String(Number.MAX_SAFE_INTEGER))).toBe(Number.MAX_SAFE_INTEGER)
+  })
+
+  test('returns null for anything that is not exact non-negative decimal digits', () => {
+    for (const raw of [
+      '',
+      '   ',
+      'notanumber',
+      '12abc',
+      '-1',
+      '3.5',
+      '0x10',
+      '1e3',
+      '1_000',
+      '+5',
+      '9007199254740993', // past MAX_SAFE_INTEGER → precision loss
+      '9'.repeat(309), // Number() → Infinity
+    ]) {
+      expect(parseDecimalDigits(raw)).toBeNull()
+    }
+  })
+})
+
+describe('parseBoundedInt', () => {
+  test('accepts in-range digit strings (inclusive bounds)', () => {
+    expect(parseBoundedInt('0', { min: 0, max: 65535, field: 'port' })).toBe(0)
+    expect(parseBoundedInt('65535', { min: 0, max: 65535, field: 'port' })).toBe(65535)
+    expect(parseBoundedInt('1000', { min: 1000, field: 'iv' })).toBe(1000)
+    expect(parseBoundedInt('  42  ', { min: 1, max: 100, field: 'n' })).toBe(42)
+  })
+
+  test.each([
+    ['65536', { min: 0, max: 65535, field: 'port' }],
+    ['999', { min: 1000, field: 'iv' }],
+    ['-1', { min: 0, max: 65535, field: 'port' }],
+    ['3.5', { min: 0, max: 65535, field: 'port' }],
+    ['0x10', { min: 0, max: 65535, field: 'port' }],
+    ['1e3', { min: 1000, field: 'iv' }],
+    ['', { min: 0, max: 65535, field: 'port' }],
+    ['9007199254740993', { min: 1000, field: 'iv' }], // past MAX_SAFE_INTEGER → precision loss
+    ['9'.repeat(309), { min: 1000, field: 'iv' }], // Number() → Infinity
+  ] as const)('rejects %p as INVALID_ARGUMENT', (value, opts) => {
+    expect(() => parseBoundedInt(value, opts)).toThrow(KanbanError)
+    try {
+      parseBoundedInt(value, opts)
+    } catch (err) {
+      expect((err as KanbanError).code).toBe(ErrorCode.INVALID_ARGUMENT)
+    }
+  })
+
+  test('message form depends on whether max is bounded', () => {
+    expect(() => parseBoundedInt('x', { min: 0, max: 65535, field: 'port' })).toThrow(
+      /port must be an integer between 0 and 65535/,
+    )
+    expect(() => parseBoundedInt('x', { min: 1000, field: '--sync-interval-ms' })).toThrow(
+      /--sync-interval-ms must be an integer >= 1000/,
+    )
+  })
+})
 
 describe('parsePositiveInt', () => {
   test('returns undefined for absent values', () => {

package/src/__tests__/tunnel.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test } from 'bun:test'
+import { startCloudflareTunnel } from '../tunnel'
+
+// The tunnel is exercised with an injected `command` so no real `cloudflared`
+// binary is needed; stdout/stderr from a tiny shell script drive URL detection,
+// and the injected log/warn/onUrl sinks let us assert behaviour deterministically.
+
+function deferred<T>(): { promise: Promise<T>; resolve: (v: T) => void } {
+  let resolve!: (v: T) => void
+  const promise = new Promise<T>((r) => {
+    resolve = r
+  })
+  return { promise, resolve }
+}
+
+describe('startCloudflareTunnel (F42/F51/F52/F53)', () => {
+  test('F51: detects the trycloudflare URL from stdout and announces once', async () => {
+    const url = 'https://random-words-1234.trycloudflare.com'
+    const got = deferred<string>()
+    const logs: string[] = []
+    const handle = startCloudflareTunnel(3000, {
+      command: ['bash', '-c', `echo "INF | ${url} |"; sleep 1`],
+      onUrl: (u) => got.resolve(u),
+      log: (m) => logs.push(m),
+      warn: () => {},
+    })
+    expect(await got.promise).toBe(url)
+    expect(logs.some((l) => l.includes(url))).toBe(true)
+    handle.stop()
+  })
+
+  test('F51: detects the URL from stderr too', async () => {
+    const url = 'https://stderr-side-9999.trycloudflare.com'
+    const got = deferred<string>()
+    const handle = startCloudflareTunnel(3000, {
+      command: ['bash', '-c', `echo "${url}" 1>&2; sleep 1`],
+      onUrl: (u) => got.resolve(u),
+      log: () => {},
+      warn: () => {},
+    })
+    expect(await got.promise).toBe(url)
+    handle.stop()
+  })
+
+  test('F51: announces exactly once even when the URL is printed repeatedly', async () => {
+    const url = 'https://dup-5678.trycloudflare.com'
+    const urls: string[] = []
+    const handle = startCloudflareTunnel(3000, {
+      command: ['bash', '-c', `for i in 1 2 3 4; do echo ${url}; done; sleep 1`],
+      onUrl: (u) => urls.push(u),
+      log: () => {},
+      warn: () => {},
+    })
+    // Give the scanner time to read all four lines before asserting.
+    await new Promise((r) => setTimeout(r, 250))
+    handle.stop()
+    expect(urls).toEqual([url])
+  })
+
+  test('D4: detects a URL split across separate stream chunks', async () => {
+    // The URL is printed in two writes separated by a sleep so they land in
+    // distinct read chunks. Per-chunk matching (pre-fix) misses it; the buffered
+    // scanner reassembles it. parts: "https://abc" + "def-1234.trycloudflare.com"
+    const url = 'https://abcdef-1234.trycloudflare.com'
+    const got = deferred<string>()
+    const handle = startCloudflareTunnel(3000, {
+      command: [
+        'bash',
+        '-c',
+        `printf 'INF | https://abc'; sleep 0.15; printf 'def-1234.trycloudflare.com |\n'; sleep 1`,
+      ],
+      onUrl: (u) => got.resolve(u),
+      log: () => {},
+      warn: () => {},
+    })
+    expect(await got.promise).toBe(url)
+    handle.stop()
+  })
+
+  test('F52: warns with an actionable message and rethrows when the binary is missing', () => {
+    let warned = ''
+    expect(() =>
+      startCloudflareTunnel(3000, {
+        command: ['cloudflared-does-not-exist-xyz-123'],
+        warn: (m) => {
+          warned = m
+        },
+        log: () => {},
+      }),
+    ).toThrow()
+    expect(warned).toContain('Failed to start cloudflared')
+  })
+
+  test('F53: warns when the process exits before a URL is established', async () => {
+    const warned = deferred<string>()
+    const handle = startCloudflareTunnel(3000, {
+      command: ['bash', '-c', 'exit 1'],
+      warn: (m) => warned.resolve(m),
+      log: () => {},
+    })
+    expect(await warned.promise).toContain('before a public URL was established')
+    handle.stop()
+  })
+
+  test('F53: stop() is best-effort and does not throw even if called twice', async () => {
+    const handle = startCloudflareTunnel(3000, {
+      command: ['bash', '-c', 'sleep 2'],
+      log: () => {},
+      warn: () => {},
+    })
+    expect(() => {
+      handle.stop()
+      handle.stop()
+    }).not.toThrow()
+  })
+})