@astralyn/sash 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.1.1] - 2026-09-08
+
+### Fixed
+
+- Start a stopped Core update from its already validated configuration before normal profile publication, preserving coordinated rollback until the health check succeeds. This also fixes first startup after installing Core with `sash update`.
+- Authorize dashboard HTTP and WebSocket control through private, single-use browser handoffs; keep credentials out of public health responses and preserve sessions across page refreshes.
+- Keep the recovery dashboard available when Core startup fails without authorizing competing starts from unknown runtime observations.
+- Fix native Windows log watching, clean font builds, temporary-directory aliases, private browser-handoff file checks and cross-platform test timing.
+- Retry ownership-safe system-proxy cleanup when an explicit disable request repeats the saved off state.
+- Preserve original transaction errors after successful rollback, retain causes on incomplete rollback and report stale settings snapshots as conflicts.
+
+### Added
+
+- Publish verified npm artifacts through GitHub Actions trusted publishing, with provenance and registry-install checks.
+- Add an npm release runbook, external package smoke checks and dependency update configuration.
+
+### Changed
+
+- Defer TUN and Windows Service Mode to the `feat/tun-service-mode` development branch. This release provides local HTTP/SOCKS endpoints and system-proxy controls, with no TUN or service administration controls.
+- Migrate enabled legacy TUN settings to off, reject new enable requests and explicitly disable TUN in generated configurations. Preserve original profile files and DNS/provider options; reject separate TUN listeners before publication.
+
 ## [0.1.0] - 2026-09-05
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 > A lightweight command-line companion and web dashboard for a rule-based network core.
 
-Sash is a **network toolbox for developers and advanced users**. It installs, runs, and maintains a rule-based network core on your machine: local HTTP/SOCKS endpoints, rule-driven traffic routing, remote profile management, live traffic inspection through a built-in web dashboard, and an optional TUN mode for device-level traffic takeover.
+Sash is a **network toolbox for developers, learning, and research**. It installs, runs, and maintains a rule-based network core on your machine: local HTTP/SOCKS endpoints, rule-driven traffic routing, remote profile management, and live traffic inspection through a built-in web dashboard.
 
 ## Features
 
@@ -12,7 +12,6 @@ Sash is a **network toolbox for developers and advanced users**. It installs, ru
 - **One-command lifecycle** — `sash start`, `stop`, `restart`, `status`, `logs`
 - **Remote profiles** — fetch, validate, schedule, and hot-reload core-format network profiles from the dashboard
 - **Verified upgrades** — SHA-256-verified downloads, bounded extraction, exact-version checks and atomic rollback (`sash update`)
-- **TUN mode** — device-level traffic takeover (requires starting the whole Sash runtime with elevated privileges)
 - **Credential hygiene** — child processes run with scrubbed environments; loopback traffic never traverses proxy dispatchers
 
 ## Requirements
@@ -49,11 +48,15 @@ sash status                # runtime state, endpoints, and proxy status
 sash stop                  # restores prior proxy state, stops core and sashd
 ```
 
+Use `sash web` to authorize and open the dashboard. Opening its address directly shows connection instructions. Refreshing an authorized tab preserves access; after restarting Sash, run `sash web` again.
+
+TUN and Windows Service Mode are deferred to the [development branch](https://github.com/ming-kang/Sash/tree/feat/tun-service-mode). Version 0.1.1 keeps TUN disabled and runs without a privileged service.
+
 ## Documentation
 
 Comprehensive documentation is available in the [`docs/`](./docs) directory:
 
-- [**User & Operations Guide**](./docs/usage.md) — complete CLI command reference, configuration parameters, TUN mode, and troubleshooting.
+- [**User & Operations Guide**](./docs/usage.md) — complete CLI command reference, configuration parameters and troubleshooting.
 - [**Backend Architecture**](./docs/backend.md) — supervisor daemon model (`sashd`), API endpoints, lifecycle management, system proxy adapters, and safety invariants.
 - [**Frontend Architecture**](./docs/frontend.md) — built-in Vue 3 + Vite dashboard, shared API contracts, reactive runtime state, and WebSocket streaming.
 - [**Third-Party Notices**](./THIRD_PARTY_NOTICES.md) — licenses and attribution for code/assets embedded in the dashboard and the runtime-downloaded Core.

package/dist/commands/lifecycle.js

@@ -1,13 +1,11 @@
 import { log } from "../log.js";
 import { ensureRunning, restartRuntime, stopRuntime } from "../runtime-owner.js";
-import { tunPrivilegeGuidance } from "../tun-guidance.js";
 import { runtimeContext } from "./shared.js";
 export async function runStart() {
     const ctx = runtimeContext();
     const { owner, result } = await ensureRunning(ctx);
     log.ok(`core started (PID=${result.pid}${result.version ? `, version ${result.version}` : ""})`);
     printEndpoints(ctx, owner.daemon.port);
-    reportTunState(ctx, result);
     if (ctx.settings.systemProxy)
         log.ok("system proxy enabled");
 }
@@ -28,20 +26,6 @@ export async function runRestart(deps = {}) {
     log.ok(`sashd ${verb} (PID=${daemonPid})`);
     log.ok(`core ${verb} (PID=${result.pid}${result.version ? `, version ${result.version}` : ""})`);
     printEndpoints(ctx, owner.daemon.port);
-    reportTunState(ctx, result);
-}
-function reportTunState(ctx, result) {
-    if (!ctx.settings.tun)
-        return;
-    if (result.tunActive === true) {
-        log.ok("TUN active");
-    }
-    else if (result.tunActive === false) {
-        log.warn(`TUN was requested but is inactive; the core remains available without TUN. ${tunPrivilegeGuidance("runtime-inactive", { root: ctx.layout.root })}`);
-    }
-    else {
-        log.warn(`TUN was requested, but its runtime state could not be verified. ${tunPrivilegeGuidance("runtime-inactive", { root: ctx.layout.root })}`);
-    }
 }
 export function printEndpoints(ctx, daemonPort) {
     log.kv("mixed port", `127.0.0.1:${ctx.settings.mixedPort}`);

package/dist/commands/status.js

@@ -1,6 +1,5 @@
 import { log } from "../log.js";
-import { collectRuntimeStatus, formatObservedProxy, formatTunObservation, markIncompleteObservation, runtimeStatusHeadline, shouldShowTunGuidance, } from "../status.js";
-import { tunPrivilegeGuidance } from "../tun-guidance.js";
+import { collectRuntimeStatus, formatObservedProxy, markIncompleteObservation, runtimeStatusHeadline, } from "../status.js";
 import { runtimeContext } from "./shared.js";
 export async function runStatus(opts = {}, collect = () => collectRuntimeStatus(runtimeContext())) {
     const status = await collect();
@@ -30,10 +29,6 @@ export async function runStatus(opts = {}, collect = () => collectRuntimeStatus(
     log.kv("active profile", status.activeProfile
         ? `${status.activeProfile.name} (${status.activeProfile.url || "local file"})`
         : "(none)");
-    log.kv("tun", formatTunObservation(status));
     log.kv("core version", status.core.installedVersion || "(not installed)");
-    if (shouldShowTunGuidance(status)) {
-        log.warn(tunPrivilegeGuidance("runtime-inactive", { root: status.paths.root }));
-    }
     markIncompleteObservation(status.complete);
 }

package/dist/commands/web.js

@@ -1,33 +1,61 @@
 import { openInBrowser } from "../browser.js";
 import { log } from "../log.js";
 import { resolveRuntimeOwner } from "../runtime-owner.js";
+import { writeBootstrapFile } from "../web-bootstrap.js";
 import { runStart } from "./lifecycle.js";
 import { runtimeContext } from "./shared.js";
 export function dashboardUrl(daemonPort) {
     return `http://127.0.0.1:${daemonPort}/ui/`;
 }
-export async function runWeb(opts = {}) {
-    const ctx = runtimeContext();
-    let owner = await resolveRuntimeOwner(ctx);
-    let coreRunning = false;
+export async function runWeb(opts = {}, deps = {}) {
+    const logger = deps.log ?? log;
+    const resolve = deps.resolveRuntimeOwner ?? resolveRuntimeOwner;
+    const ctx = (deps.runtimeContext ?? runtimeContext)();
+    let owner = await resolve(ctx);
+    let coreRunning = null;
     if (owner.kind === "daemon") {
         try {
             coreRunning = (await owner.client.status()).core.running;
         }
         catch {
-            coreRunning = false;
+            logger.warn("Core state is unavailable; opening the dashboard for recovery.");
         }
     }
-    if (!coreRunning) {
-        log.info("sash is not running; starting it first...");
-        await runStart();
-        owner = await resolveRuntimeOwner(ctx);
+    if (owner.kind === "offline" || coreRunning === false) {
+        logger.info("sash is not running; starting it first...");
+        let started = false;
+        try {
+            await (deps.runStart ?? runStart)();
+            started = true;
+        }
+        catch (error) {
+            try {
+                owner = await resolve(ctx);
+            }
+            catch {
+                throw error;
+            }
+            if (owner.kind !== "daemon")
+                throw error;
+            logger.warn(`Core startup failed; opening the dashboard for recovery: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (started)
+            owner = await resolve(ctx);
     }
     if (owner.kind !== "daemon") {
         throw new Error("sashd did not become healthy before opening the dashboard");
     }
     const url = dashboardUrl(owner.daemon.port);
-    log.ok(`dashboard: ${url}`);
-    if (!opts.noOpen)
-        openInBrowser(url);
+    if (opts.noOpen) {
+        logger.ok(`dashboard: ${url}`);
+        logger.info("run 'sash web' without --no-open to authorize a browser session");
+        return;
+    }
+    const bootstrap = await owner.client.createWebBootstrap();
+    const file = (deps.writeBootstrap ?? writeBootstrapFile)(ctx.layout, {
+        dashboardUrl: url,
+        ...bootstrap,
+    });
+    (deps.openInBrowser ?? openInBrowser)(file.fileUrl);
+    logger.ok(`dashboard: ${url}`);
 }

package/dist/contracts.js

@@ -163,6 +163,22 @@ export function parseHealthInfo(value) {
         startedAt: timestampValue(required(source, "startedAt", contract, "startedAt"), contract, "startedAt"),
     };
 }
+export function parseWebBootstrapInfo(value) {
+    const contract = "sashd web bootstrap";
+    const source = objectValue(value, contract, "response");
+    return {
+        token: stringValue(required(source, "token", contract, "token"), contract, "token", true),
+        expiresAt: timestampValue(required(source, "expiresAt", contract, "expiresAt"), contract, "expiresAt"),
+    };
+}
+export function parseWebSessionInfo(value) {
+    const contract = "sashd web session";
+    const source = objectValue(value, contract, "response");
+    return {
+        token: stringValue(required(source, "token", contract, "token"), contract, "token", true),
+        daemonToken: stringValue(required(source, "daemonToken", contract, "daemonToken"), contract, "daemonToken", true),
+    };
+}
 export function parseCoreStartResult(value) {
     const contract = "sashd core start";
     const source = objectValue(value, contract, "response");

package/dist/daemon/app.js

@@ -12,6 +12,7 @@ import { StateMutationQueue } from "../state-lock.js";
 import { CoreSupervisor } from "../supervisor.js";
 import { SystemProxyManager } from "../system-proxy-manager.js";
 import { DaemonGate } from "./context.js";
+import { WebAuthManager } from "./web-auth.js";
 export function buildDaemonContext(deps) {
     const layout = deps.layout;
     let committedSettings = saveSettings({ ...deps.settings }, layout);
@@ -89,6 +90,9 @@ export function buildDaemonContext(deps) {
         boundary: "already-held",
     });
     const startCore = async () => {
+        if (readCoreUpdateTransaction(layout)) {
+            return mutate("start pending Core update", () => lifecycle.start());
+        }
         const retryAfterPreparation = Symbol("retry Core start after preparation");
         for (;;) {
             let prepared;
@@ -132,6 +136,7 @@ export function buildDaemonContext(deps) {
         layout,
         token,
         startedAt,
+        webAuth: new WebAuthManager(),
         profiles,
         settingsService,
         lifecycle,
@@ -145,9 +150,11 @@ export function buildDaemonContext(deps) {
         mutate,
         profileRevision: () => profileRevision,
         startCore,
-        restartCore: () => withPreparedReloadRetry("restart core", (prepared) => lifecycle.restart(async () => {
-            await commitPreparedReload(prepared, false);
-        })),
+        restartCore: () => readCoreUpdateTransaction(layout)
+            ? startCore()
+            : withPreparedReloadRetry("restart core", (prepared) => lifecycle.restart(async () => {
+                await commitPreparedReload(prepared, false);
+            })),
         reloadCoreConfig: () => withPreparedReloadRetry("reload core config", (prepared) => commitPreparedReload(prepared, true)),
         shutdown: () => gate.shutdown(),
         closeListener: () => Promise.reject(new Error("listener close is not wired yet")),

package/dist/daemon/errors.js

@@ -1,6 +1,6 @@
 import { HttpError } from "../daemon-http.js";
 import { ProfileConflictError, ProfileInputError, ProfileNotFoundError, } from "../profile-service.js";
-import { CoreUnhealthyError, SettingsInputError } from "../settings-service.js";
+import { CoreUnhealthyError, SettingsConflictError, SettingsInputError, } from "../settings-service.js";
 export class ShuttingDownError extends Error {
     constructor(message = "sashd is shutting down") {
         super(message);
@@ -39,6 +39,8 @@ export function errorToHttp(err) {
         return { status: 400, code: "invalid_input", message };
     if (err instanceof ProfileConflictError)
         return { status: 409, code: "conflict", message };
+    if (err instanceof SettingsConflictError)
+        return { status: 409, code: "conflict", message };
     if (err instanceof CoreUnhealthyError)
         return { status: 409, code: "core_unhealthy", message };
     if (err instanceof ShuttingDownError)

package/dist/daemon/handlers/daemon.js

@@ -1,9 +1,24 @@
 import { currentCoreVersion } from "../../core.js";
+import { HttpError } from "../../daemon-http.js";
 import { publicSettings } from "../../settings.js";
 export function health(ctx) {
     const body = { token: ctx.token, pid: process.pid, startedAt: ctx.startedAt };
     return { status: 200, json: body };
 }
+export function createWebBootstrap(ctx) {
+    const bootstrap = ctx.webAuth.createBootstrap();
+    const body = { token: bootstrap.token, expiresAt: bootstrap.expiresAt };
+    return { status: 200, json: body };
+}
+export async function redeemWebBootstrap(ctx, req) {
+    const body = await req.readJson(1024);
+    const token = typeof body.token === "string" ? body.token.trim() : "";
+    const session = ctx.webAuth.redeemBootstrap(token);
+    if (!session)
+        throw new HttpError(401, "Invalid or expired bootstrap token");
+    const response = { token: session, daemonToken: ctx.token };
+    return { status: 200, json: response };
+}
 export async function daemonStatus(ctx, req) {
     const settings = ctx.settings.committed();
     const runtimeCore = await ctx.supervisor.status();

package/dist/daemon/router.js

@@ -4,7 +4,7 @@ import { forwardHttpToCore } from "../daemon-proxy.js";
 import { serveStaticUi } from "../daemon-static.js";
 import { errorToHttp } from "./errors.js";
 import { reloadCoreConfig, restartCore, startCore, stopCore } from "./handlers/core.js";
-import { daemonStatus, health, shutdownDaemon } from "./handlers/daemon.js";
+import { createWebBootstrap, daemonStatus, health, redeemWebBootstrap, shutdownDaemon, } from "./handlers/daemon.js";
 import { activateProfile, addProfile, importProfile, listProfiles, readProfileContent, removeProfile, renameProfile, updateAllProfiles, updateProfile, writeProfileContent, } from "./handlers/profiles.js";
 import { proxyStatus } from "./handlers/proxy.js";
 import { patchSettings, readSettings, readSettingsFile, writeSettingsFile, } from "./handlers/settings.js";
@@ -49,6 +49,18 @@ export function buildRoutes() {
             auth: "control",
             handler: shutdownDaemon,
         },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/web/bootstrap"),
+            auth: "control",
+            handler: createWebBootstrap,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/web/session"),
+            auth: "public",
+            handler: redeemWebBootstrap,
+        },
         { methods: ["POST"], pattern: path("/sash/core/start"), auth: "control", handler: startCore },
         { methods: ["POST"], pattern: path("/sash/core/stop"), auth: "control", handler: stopCore },
         {
@@ -83,12 +95,8 @@ export function buildRoutes() {
             auth: "control",
             handler: writeSettingsFile,
         },
-        {
-            methods: ["GET", "POST"],
-            pattern: path("/sash/profiles"),
-            auth: "public",
-            handler: (ctx, req) => (req.method === "POST" ? addProfile(ctx, req) : listProfiles(ctx)),
-        },
+        { methods: ["GET"], pattern: path("/sash/profiles"), auth: "public", handler: listProfiles },
+        { methods: ["POST"], pattern: path("/sash/profiles"), auth: "control", handler: addProfile },
         {
             methods: ["POST"],
             pattern: path("/sash/profiles/import"),
@@ -252,7 +260,7 @@ export async function dispatch(ctx, routes, req, res) {
     if (requiresAuth &&
         !isControlRequestAuthorized(req, {
             daemonSecret: ctx.settings.committed().daemonSecret,
-            bootToken: ctx.token,
+            isSessionToken: (token) => ctx.webAuth.isSession(token),
         })) {
         sendError(res, 401, "unauthorized", "Unauthorized control request");
         return;

package/dist/daemon/server.js

@@ -38,7 +38,7 @@ export function createDaemonServer(deps) {
         }
         if (!isWebSocketRequestAuthorized(req, {
             daemonSecret: context.settings.committed().daemonSecret,
-            bootToken: context.token,
+            isSessionToken: (token) => context.webAuth.isSession(token),
         })) {
             rejectUpgrade(socket, 401, "Unauthorized WebSocket request");
             return;

package/dist/daemon/web-auth.js

@@ -0,0 +1,52 @@
+import crypto from "node:crypto";
+export const WEB_BOOTSTRAP_TTL_MS = 90_000;
+const MAX_PENDING_BOOTSTRAPS = 32;
+const MAX_SESSIONS = 256;
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+export class WebAuthManager {
+    pendingBootstraps = new Map();
+    sessions = new Map();
+    createBootstrap(now = Date.now()) {
+        this.sweepExpired(now);
+        while (this.pendingBootstraps.size >= MAX_PENDING_BOOTSTRAPS) {
+            const oldest = this.pendingBootstraps.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.pendingBootstraps.delete(oldest);
+        }
+        const token = crypto.randomBytes(32).toString("hex");
+        const expiresAtMs = now + WEB_BOOTSTRAP_TTL_MS;
+        this.pendingBootstraps.set(hashToken(token), expiresAtMs);
+        return { token, expiresAt: new Date(expiresAtMs).toISOString() };
+    }
+    redeemBootstrap(token, now = Date.now()) {
+        this.sweepExpired(now);
+        if (!token)
+            return null;
+        const key = hashToken(token);
+        const expiresAt = this.pendingBootstraps.get(key);
+        if (expiresAt === undefined || expiresAt <= now)
+            return null;
+        this.pendingBootstraps.delete(key);
+        while (this.sessions.size >= MAX_SESSIONS) {
+            const oldest = this.sessions.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.sessions.delete(oldest);
+        }
+        const session = crypto.randomBytes(32).toString("hex");
+        this.sessions.set(hashToken(session), true);
+        return session;
+    }
+    isSession(token) {
+        return token !== "" && this.sessions.has(hashToken(token));
+    }
+    sweepExpired(now) {
+        for (const [key, expiresAt] of this.pendingBootstraps) {
+            if (expiresAt <= now)
+                this.pendingBootstraps.delete(key);
+        }
+    }
+}

package/dist/daemon-auth.js

@@ -41,7 +41,7 @@ export function isControlRequestAuthorized(req, opts) {
     if (bearer && opts.daemonSecret && secretsEqual(bearer, opts.daemonSecret))
         return true;
     const webToken = firstHeader(req.headers["x-sash-token"]).trim();
-    return Boolean(webToken && secretsEqual(webToken, opts.bootToken));
+    return Boolean(webToken && opts.isSessionToken(webToken));
 }
 function webSocketProtocols(value) {
     return (Array.isArray(value) ? value.join(",") : (value ?? ""))
@@ -56,7 +56,7 @@ export function isWebSocketRequestAuthorized(req, opts) {
         if (!protocol.startsWith(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX))
             return false;
         const token = protocol.slice(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX.length);
-        return Boolean(token && secretsEqual(token, opts.bootToken));
+        return opts.isSessionToken(token);
     });
 }
 export function webSocketAuthResponseProtocol(value) {

package/dist/daemon-client.js

@@ -32,6 +32,9 @@ export class SashDaemonClient {
     health() {
         return this.client.health();
     }
+    createWebBootstrap() {
+        return this.client.createWebBootstrap();
+    }
     async isReachable() {
         try {
             return Boolean((await this.health()).token);
@@ -46,6 +49,9 @@ export class SashDaemonClient {
     startCore() {
         return this.client.startCore();
     }
+    patchSettings(patch) {
+        return this.client.patchSettings(patch);
+    }
     maintenanceShutdown() {
         return this.client.shutdown();
     }

package/dist/daemon-http.js

@@ -85,6 +85,7 @@ export function sendJson(res, statusCode, data) {
     res.writeHead(statusCode, {
         "Content-Type": "application/json; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),
+        "Cache-Control": "no-store",
     });
     res.end(body);
 }

package/dist/log-follow.js

@@ -193,7 +193,8 @@ export function followLogFile(file, options) {
             if (watcher || stopped)
                 return;
             try {
-                const watched = fs.watch(path.dirname(file), (_event, filename) => {
+                const directory = fs.realpathSync.native(path.dirname(file));
+                const watched = fs.watch(directory, (_event, filename) => {
                     if (filename === null || filename.toString() === path.basename(file))
                         scheduleDrain();
                 });

package/dist/managed-state-transaction.js

@@ -292,10 +292,9 @@ export async function retainManagedStateTransaction(layout, transaction, files =
                 rollbackErrors.push(`journal: ${clearErr.message}`);
             }
         }
-        const suffix = rollbackErrors.length
-            ? `; managed-state transaction rollback failed: ${rollbackErrors.join("; ")}`
-            : "";
-        throw new Error(`${err.message}${suffix}`);
+        if (rollbackErrors.length === 0)
+            throw err;
+        throw new Error(`${err.message}; managed-state transaction rollback failed: ${rollbackErrors.join("; ")}`, { cause: err });
     }
 }
 export function rollbackRetainedManagedStateTransaction(layout, files = defaultManagedStateFileOperations) {
@@ -369,9 +368,8 @@ export async function commitManagedStateTransaction(layout, transaction, reloadC
                 rollbackErrors.push(`journal: ${clearErr.message}`);
             }
         }
-        const suffix = rollbackErrors.length
-            ? `; managed-state transaction rollback failed: ${rollbackErrors.join("; ")}`
-            : "";
-        throw new Error(`${err.message}${suffix}`);
+        if (rollbackErrors.length === 0)
+            throw err;
+        throw new Error(`${err.message}; managed-state transaction rollback failed: ${rollbackErrors.join("; ")}`, { cause: err });
     }
 }

package/dist/mihomo-config.js

@@ -1,6 +1,7 @@
 import { isIP } from "node:net";
 import YAML from "yaml";
 import { ERROR_BODY_LIMIT, fetchWithRetry } from "./http.js";
+import { isPlainObject } from "./json-shape.js";
 export function buildDefaultConfig() {
     return {
         mode: "rule",
@@ -312,14 +313,10 @@ export function overlayManagedKeys(base, settings) {
     out["allow-lan"] = settings.allowLan;
     out["external-controller"] = settings.controller;
     out.secret = settings.secret;
-    if (settings.tun) {
-        out.tun = {
-            enable: true,
-            stack: "mixed",
-            "auto-route": true,
-            "auto-detect-interface": true,
-            "dns-hijack": ["any:53"],
-        };
+    out.tun = { enable: false };
+    if (Array.isArray(out.listeners) &&
+        out.listeners.some((listener) => isPlainObject(listener) && listener.type === "tun")) {
+        throw new Error("TUN listeners are unavailable in this release");
     }
     return out;
 }

package/dist/sash-client.js

@@ -1,4 +1,4 @@
-import { parseApiErrorBody, parseCoreReloadResult, parseCoreStartResult, parseDaemonStatus, parseHealthInfo, parseProfileActionResponse, parseProfileActivateResponse, parseProfileContentResponse, parseProfileRemoveResponse, parseProfileRenameResponse, parseProfilesIndex, parseProfilesUpdateAllResponse, parseProfileUpdateResponse, parsePublicSettings, parseSettingsFileContent, parseSettingsWriteResult, parseShutdownResult, parseSystemProxyStatusResponse, } from "./contracts.js";
+import { parseApiErrorBody, parseCoreReloadResult, parseCoreStartResult, parseDaemonStatus, parseHealthInfo, parseProfileActionResponse, parseProfileActivateResponse, parseProfileContentResponse, parseProfileRemoveResponse, parseProfileRenameResponse, parseProfilesIndex, parseProfilesUpdateAllResponse, parseProfileUpdateResponse, parsePublicSettings, parseSettingsFileContent, parseSettingsWriteResult, parseShutdownResult, parseSystemProxyStatusResponse, parseWebBootstrapInfo, parseWebSessionInfo, } from "./contracts.js";
 const defaultFetch = async (url, init) => {
     const response = await fetch(url, {
         method: init.method,
@@ -24,6 +24,7 @@ export class SashClient {
     tokenHeader;
     fetchFn;
     timeoutMs;
+    onUnauthorized;
     constructor(options) {
         this.baseUrl = options.baseUrl.replace(/\/+$/, "");
         if (options.token)
@@ -31,10 +32,12 @@ export class SashClient {
         this.tokenHeader = options.tokenHeader ?? "authorization";
         this.fetchFn = options.fetchFn ?? defaultFetch;
         this.timeoutMs = options.timeoutMs ?? 5_000;
+        if (options.onUnauthorized)
+            this.onUnauthorized = options.onUnauthorized;
     }
     async request(endpoint, options = {}) {
         const headers = {};
-        const token = this.token?.() ?? "";
+        const token = options.authenticate === false ? "" : (this.token?.() ?? "");
         if (token) {
             if (this.tokenHeader === "x-sash-token")
                 headers["X-Sash-Token"] = token;
@@ -64,6 +67,8 @@ export class SashClient {
             }
             data = text;
         }
+        if (response.status === 401 && token)
+            this.onUnauthorized?.(token);
         if (response.status < 200 || response.status >= 300) {
             const parsedError = parseApiErrorBody(data);
             const message = parsedError?.message ?? (typeof data === "string" ? data.slice(0, 300).trim() : "");
@@ -72,7 +77,23 @@ export class SashClient {
         return data;
     }
     async health() {
-        return parseHealthInfo(await this.request("/sash/daemon/health", { timeoutMs: 2_000, attempts: 1 }));
+        return parseHealthInfo(await this.request("/sash/daemon/health", {
+            timeoutMs: 2_000,
+            attempts: 1,
+            authenticate: false,
+        }));
+    }
+    async createWebBootstrap() {
+        return parseWebBootstrapInfo(await this.request("/sash/web/bootstrap", { method: "POST", timeoutMs: 5_000 }));
+    }
+    async redeemWebBootstrap(token) {
+        return parseWebSessionInfo(await this.request("/sash/web/session", {
+            method: "POST",
+            body: { token },
+            timeoutMs: 5_000,
+            attempts: 1,
+            authenticate: false,
+        }));
     }
     async status(fresh = false) {
         return parseDaemonStatus(await this.request(fresh ? "/sash/daemon/status?fresh=1" : "/sash/daemon/status"));