@atomic-chat/core 0.5.1

package/dist/remote-access/journal.js

@@ -0,0 +1,140 @@
+/**
+ * Crash recovery for the tunnel process.
+ *
+ * A normal shutdown ends cloudflared, but a crash, an OOM kill or a force quit runs none of that. An
+ * orphaned tunnel is worse than an orphaned model backend: it keeps a *public* URL pointed at a local
+ * port that is now dead — or that the next process to bind it inherits.
+ *
+ * The process journal of the model backends does not fit: a tunnel has no provider, model or port,
+ * and people who want this feature often run a `cloudflared` of their own that must never be
+ * touched. So the tunnel gets its own record, and is ended only when two independent checks agree:
+ * the recorded start identity (the PID-reuse guard) and the process name.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/journal.rs (image-generation line, `767ff6350`).
+ */
+import { readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { isProcessAlive, processName, processStartEpoch, processStartId, verifyProcessIdentity, } from '../lock/index.js';
+export const TUNNEL_JOURNAL_FILE = 'remote-access-tunnel.json';
+const PROCESS_NAME_PREFIX = 'cloudflared';
+/** The kernel's start time and our clock reading a moment after `spawn` differ by a second or two at most. */
+const START_TIME_TOLERANCE_SECS = 5;
+export function isTunnelName(name) {
+    return name !== undefined && name.trim().toLowerCase().startsWith(PROCESS_NAME_PREFIX);
+}
+/** Records the live tunnel. Best effort: a journal that cannot be written costs crash recovery, never the tunnel. */
+export class TunnelJournal {
+    path;
+    instanceId;
+    deps;
+    writes = Promise.resolve();
+    constructor(path, instanceId, deps = {}) {
+        this.path = path;
+        this.instanceId = instanceId;
+        this.deps = deps;
+    }
+    /**
+     * Written at once with what is known, then again with the start identity: the identity probe takes
+     * about a second on Windows, and a crash inside that second must still leave a trail.
+     */
+    record(pid, exe) {
+        const entry = {
+            pid,
+            process_start_id: null,
+            started_at_secs: Math.floor((this.deps.now ?? Date.now)() / 1000),
+            instance_id: this.instanceId,
+            exe,
+        };
+        return this.enqueue(async () => {
+            await this.write(entry);
+            const startId = await (this.deps.startId ?? processStartId)(pid).catch(() => undefined);
+            if (startId !== undefined && (await this.current())?.pid === pid)
+                await this.write({ ...entry, process_start_id: startId });
+        });
+    }
+    clear() {
+        return this.enqueue(() => rm(this.path, { force: true }));
+    }
+    async current() {
+        return parseEntry(await readFile(this.path, 'utf8').catch(() => ''));
+    }
+    async write(entry) {
+        // Write-then-rename: a crash mid-write must not leave a journal the next startup cannot parse.
+        const temporary = `${this.path}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(entry)}\n`);
+        await rename(temporary, this.path);
+    }
+    enqueue(operation) {
+        const next = this.writes.then(operation).catch((error) => {
+            this.deps.log?.(`could not update the remote-access journal: ${error.message}`);
+        });
+        this.writes = next;
+        return next;
+    }
+}
+/**
+ * Also reads the entry Atomic Chat 2.0.40 wrote at the data root, `{pid, started_at_secs}`: it has no
+ * start identity, so the start-time fallback decides.
+ */
+function parseEntry(text) {
+    try {
+        const value = JSON.parse(text);
+        if (!value || !Number.isInteger(value.pid) || value.pid <= 0)
+            return undefined;
+        return {
+            pid: value.pid,
+            process_start_id: typeof value.process_start_id === 'string' ? value.process_start_id : null,
+            started_at_secs: typeof value.started_at_secs === 'number' ? value.started_at_secs : 0,
+            instance_id: typeof value.instance_id === 'string' ? value.instance_id : '',
+            exe: typeof value.exe === 'string' ? value.exe : '',
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Ends the tunnel a previous, abnormally ended owner left behind. Called once at startup, before the
+ * endpoint is published and before anything could have started a new one.
+ */
+export async function reapTunnelOrphan(path, deps = {}) {
+    const log = deps.log ?? (() => { });
+    const text = await readFile(path, 'utf8').catch(() => undefined);
+    if (text === undefined)
+        return 'none';
+    // Whatever it says, it describes a previous run; never read it twice.
+    await rm(path, { force: true }).catch(() => { });
+    const entry = parseEntry(text);
+    if (!entry) {
+        log('ignoring an unreadable remote-access journal');
+        return 'none';
+    }
+    const alive = deps.alive ?? isProcessAlive;
+    if (entry.pid === (deps.selfPid ?? process.pid) || !alive(entry.pid))
+        return 'gone';
+    const name = await (deps.name ?? processName)(entry.pid);
+    const sameProcess = await isRecordedProcess(entry, deps);
+    if (!sameProcess || !isTunnelName(name)) {
+        log(`pid ${entry.pid} is no longer our tunnel (${name ?? 'unknown'}); leaving it alone`);
+        return 'spared';
+    }
+    try {
+        ;
+        (deps.kill ?? ((pid) => process.kill(pid, 'SIGKILL')))(entry.pid);
+        log(`ended a tunnel (pid ${entry.pid}) orphaned by a previous run`);
+        return 'killed';
+    }
+    catch {
+        return 'gone';
+    }
+}
+/** The PID-reuse guard: the recorded identity when there is one, else the start time within tolerance. */
+async function isRecordedProcess(entry, deps) {
+    if (entry.process_start_id !== null) {
+        const verdict = await (deps.verifyIdentity ?? verifyProcessIdentity)(entry.pid, entry.process_start_id);
+        return verdict === 'match';
+    }
+    const epoch = await (deps.startEpoch ?? processStartEpoch)(entry.pid);
+    const startedAt = Number(epoch?.slice('epoch:'.length));
+    return (Number.isFinite(startedAt) && Math.abs(startedAt - entry.started_at_secs) <= START_TIME_TOLERANCE_SECS);
+}
+//# sourceMappingURL=journal.js.map

package/dist/remote-access/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../src/remote-access/journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EACL,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,qBAAqB,GACtB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAC9D,MAAM,mBAAmB,GAAG,aAAa,CAAA;AACzC,8GAA8G;AAC9G,MAAM,yBAAyB,GAAG,CAAC,CAAA;AA+BnC,MAAM,UAAU,YAAY,CAAC,IAAwB;IACnD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACxF,CAAC;AAED,qHAAqH;AACrH,MAAM,OAAO,aAAa;IAIL;IACA;IACA;IALX,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAEjD,YACmB,IAAY,EACZ,UAAkB,EAClB,OAA0B,EAAE;QAF5B,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAwB;IAC5C,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,GAAW,EAAE,GAAW;QAC7B,MAAM,KAAK,GAAuB;YAChC,GAAG;YACH,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;YACjE,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,GAAG;SACJ,CAAA;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,KAAK,GAAG;gBAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACtE,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAyB;QAC3C,+FAA+F;QAC/F,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAA;QACpC,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC;IAEO,OAAO,CAAC,SAA8B;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,+CAA+C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACjF,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,CAAA;QACpE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAK,KAAK,CAAC,GAAc,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC1F,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAa;YACxB,gBAAgB,EAAE,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YAC5F,eAAe,EAAE,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACtF,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAC3E,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;SACpD,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAiB,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACrC,sEAAsE;IACtE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,8CAA8C,CAAC,CAAA;QACnD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAA;IAC1C,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAA;IAEnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,6BAA6B,IAAI,IAAI,SAAS,qBAAqB,CAAC,CAAA;QACxF,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClE,GAAG,CAAC,uBAAuB,KAAK,CAAC,GAAG,8BAA8B,CAAC,CAAA;QACnE,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,iBAAiB,CAAC,KAAyB,EAAE,IAAc;IACxE,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACvG,OAAO,OAAO,KAAK,OAAO,CAAA;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,CACvG,CAAA;AACH,CAAC"}

package/dist/remote-access/lan-probe.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Reading this machine's network: its interfaces, and the address it would use to reach the
+ * internet. The selection over what they return is pure and lives in `lan.ts`.
+ */
+import { networkInterfaces } from 'node:os';
+import type { InterfaceAddress } from './lan.js';
+/** The part of a UDP socket the default-route lookup uses; a seam for a machine with no network. */
+export interface UdpProbeSocket {
+    once(event: 'error', listener: (error: Error) => void): unknown;
+    connect(port: number, address: string, callback: () => void): void;
+    address(): {
+        address: string;
+    };
+    close(): void;
+}
+export interface LanProbeDeps {
+    interfaces?: () => ReturnType<typeof networkInterfaces>;
+    defaultRoute?: () => Promise<string | undefined>;
+}
+/** Every IPv4 address of every interface, in a stable order. */
+export declare function interfaceAddresses(read?: () => ReturnType<typeof networkInterfaces>): InterfaceAddress[];
+/**
+ * The local address the OS would use to reach the internet. `connect` on a UDP socket only fixes
+ * the local end; nothing is sent. `undefined` when there is no route, or no answer in time.
+ */
+export declare function defaultRouteAddress(timeoutMs?: number, open?: () => UdpProbeSocket): Promise<string | undefined>;
+/** What to show under "reachable on your network", default-route address first. */
+export declare function lanAddresses(deps?: LanProbeDeps): Promise<string[]>;

package/dist/remote-access/lan-probe.js

@@ -0,0 +1,63 @@
+/**
+ * Reading this machine's network: its interfaces, and the address it would use to reach the
+ * internet. The selection over what they return is pure and lives in `lan.ts`.
+ */
+import { createSocket } from 'node:dgram';
+import { networkInterfaces } from 'node:os';
+import { selectLanAddresses, sortInterfaceAddresses } from './lan.js';
+/** How long the default-route lookup may take before the list is shown without it. */
+const DEFAULT_ROUTE_TIMEOUT_MS = 1000;
+/** Every IPv4 address of every interface, in a stable order. */
+export function interfaceAddresses(read = networkInterfaces) {
+    const found = [];
+    for (const [name, addresses] of Object.entries(read()))
+        for (const entry of addresses ?? [])
+            if (entry.family === 'IPv4')
+                found.push({ name, address: entry.address });
+    return sortInterfaceAddresses(found);
+}
+/**
+ * The local address the OS would use to reach the internet. `connect` on a UDP socket only fixes
+ * the local end; nothing is sent. `undefined` when there is no route, or no answer in time.
+ */
+export function defaultRouteAddress(timeoutMs = DEFAULT_ROUTE_TIMEOUT_MS, open = () => createSocket('udp4')) {
+    return new Promise((resolve) => {
+        const socket = open();
+        let settled = false;
+        const finish = (address) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                socket.close();
+            }
+            catch {
+                // Never opened, or already closed.
+            }
+            resolve(address);
+        };
+        const timer = setTimeout(() => finish(undefined), timeoutMs);
+        timer.unref?.();
+        socket.once('error', () => finish(undefined));
+        try {
+            socket.connect(80, '8.8.8.8', () => {
+                try {
+                    finish(socket.address().address);
+                }
+                catch {
+                    finish(undefined);
+                }
+            });
+        }
+        catch {
+            finish(undefined);
+        }
+    });
+}
+/** What to show under "reachable on your network", default-route address first. */
+export async function lanAddresses(deps = {}) {
+    const defaultRoute = await (deps.defaultRoute ?? defaultRouteAddress)();
+    return selectLanAddresses(interfaceAddresses(deps.interfaces), defaultRoute);
+}
+//# sourceMappingURL=lan-probe.js.map

package/dist/remote-access/lan-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-probe.js","sourceRoot":"","sources":["../../src/remote-access/lan-probe.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAGrE,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAerC,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAChC,OAAmD,iBAAiB;IAEpE,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,SAAS,IAAI,EAAE;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAC7E,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAS,GAAG,wBAAwB,EACpC,OAA6B,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAEvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,EAAE,CAAA;QACrB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,OAA2B,EAAE,EAAE;YAC7C,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAA;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,CAAA;QAClB,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;QAC5D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;gBACjC,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,SAAS,CAAC,CAAA;gBACnB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,SAAS,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC,EAAE,CAAA;IACvE,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAA;AAC9E,CAAC"}

package/dist/remote-access/lan.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The addresses another device on the network can dial, for display only.
+ *
+ * Host validation does not depend on this list: the public listener trusts the local address of each
+ * accepted socket (`server/public/dynamic-hosts.ts`), which stays correct across sleep/wake and
+ * network changes. This only answers "what do I type on my phone?", so it may hide addresses that
+ * would work but would confuse (a WSL or Docker bridge) without breaking anybody.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/lan.rs (image-generation line, `767ff6350`).
+ */
+/** One IPv4 address of one network interface. */
+export interface InterfaceAddress {
+    name: string;
+    address: string;
+}
+export declare function isVirtualInterface(name: string): boolean;
+/**
+ * Carrier-grade NAT space, which is where Tailscale hands out addresses. On macOS those live on a
+ * `utun` interface, on Windows and Linux on a plainly named one; this keeps a mesh-VPN address
+ * visible on all three.
+ */
+export declare function isSharedAddressSpace(address: string): boolean;
+/** Not loopback, link-local, multicast, broadcast or unspecified — and an IPv4 literal at all. */
+export declare function isDialable(address: string): boolean;
+/**
+ * What to show, and in which order. The default-route address comes first because it is almost
+ * always the one the user means.
+ */
+export declare function selectLanAddresses(interfaces: readonly InterfaceAddress[], defaultRoute?: string | undefined): string[];
+/** Order by interface name, then numerically by address: the OS enumerates in no promised order. */
+export declare function sortInterfaceAddresses(interfaces: readonly InterfaceAddress[]): InterfaceAddress[];

package/dist/remote-access/lan.js

@@ -0,0 +1,90 @@
+/**
+ * The addresses another device on the network can dial, for display only.
+ *
+ * Host validation does not depend on this list: the public listener trusts the local address of each
+ * accepted socket (`server/public/dynamic-hosts.ts`), which stays correct across sleep/wake and
+ * network changes. This only answers "what do I type on my phone?", so it may hide addresses that
+ * would work but would confuse (a WSL or Docker bridge) without breaking anybody.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/lan.rs (image-generation line, `767ff6350`).
+ */
+/**
+ * Interface-name prefixes of adapters another device cannot reach. Matched case-insensitively
+ * against the start of the name.
+ */
+const VIRTUAL_INTERFACE_PREFIXES = [
+    // Windows (the friendly alias)
+    'vethernet',
+    'virtualbox',
+    'vmware',
+    // Linux
+    'docker',
+    'br-',
+    'veth',
+    'virbr',
+    // macOS
+    'bridge',
+    'utun',
+    'awdl',
+    'llw',
+];
+export function isVirtualInterface(name) {
+    const lower = name.trim().toLowerCase();
+    return VIRTUAL_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+function octets(address) {
+    const parts = address.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    const numbers = parts.map((part) => (/^\d{1,3}$/.test(part) ? Number(part) : NaN));
+    if (numbers.some((n) => Number.isNaN(n) || n > 255))
+        return undefined;
+    return numbers;
+}
+/**
+ * Carrier-grade NAT space, which is where Tailscale hands out addresses. On macOS those live on a
+ * `utun` interface, on Windows and Linux on a plainly named one; this keeps a mesh-VPN address
+ * visible on all three.
+ */
+export function isSharedAddressSpace(address) {
+    const parsed = octets(address);
+    return parsed !== undefined && parsed[0] === 100 && parsed[1] >= 64 && parsed[1] < 128;
+}
+/** Not loopback, link-local, multicast, broadcast or unspecified — and an IPv4 literal at all. */
+export function isDialable(address) {
+    const parsed = octets(address);
+    if (!parsed)
+        return false;
+    const [a, b, c, d] = parsed;
+    const loopback = a === 127;
+    const linkLocal = a === 169 && b === 254;
+    const multicast = a >= 224 && a <= 239;
+    const broadcast = a === 255 && b === 255 && c === 255 && d === 255;
+    const unspecified = a === 0 && b === 0 && c === 0 && d === 0;
+    return !(loopback || linkLocal || multicast || broadcast || unspecified);
+}
+/**
+ * What to show, and in which order. The default-route address comes first because it is almost
+ * always the one the user means.
+ */
+export function selectLanAddresses(interfaces, defaultRoute) {
+    const selected = [];
+    const push = (address) => {
+        if (isDialable(address) && !selected.includes(address))
+            selected.push(address);
+    };
+    if (defaultRoute !== undefined)
+        push(defaultRoute);
+    for (const { name, address } of interfaces) {
+        if (isVirtualInterface(name) && !isSharedAddressSpace(address))
+            continue;
+        push(address);
+    }
+    return selected;
+}
+/** Order by interface name, then numerically by address: the OS enumerates in no promised order. */
+export function sortInterfaceAddresses(interfaces) {
+    const key = (address) => (octets(address) ?? [0, 0, 0, 0]).reduce((sum, part) => sum * 256 + part, 0);
+    return [...interfaces].sort((left, right) => left.name === right.name ? key(left.address) - key(right.address) : left.name < right.name ? -1 : 1);
+}
+//# sourceMappingURL=lan.js.map

package/dist/remote-access/lan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan.js","sourceRoot":"","sources":["../../src/remote-access/lan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;;GAGG;AACH,MAAM,0BAA0B,GAAG;IACjC,+BAA+B;IAC/B,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAClF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACrE,OAAO,OAA2C,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;AACxF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAA;IAC3B,MAAM,QAAQ,GAAG,CAAC,KAAK,GAAG,CAAA;IAC1B,MAAM,SAAS,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAA;IACxC,MAAM,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAA;IACtC,MAAM,SAAS,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAA;IAClE,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO,CAAC,CAAC,QAAQ,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,IAAI,WAAW,CAAC,CAAA;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAuC,EACvC,YAAiC;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;QAC/B,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChF,CAAC,CAAA;IACD,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;QAC3C,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YAAE,SAAQ;QACxE,IAAI,CAAC,OAAO,CAAC,CAAA;IACf,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sBAAsB,CAAC,UAAuC;IAC5E,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAC9B,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpG,CAAA;AACH,CAAC"}

package/dist/remote-access/manager.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Remote access: a Cloudflare quick tunnel in front of the Local API Server.
+ *
+ * `cloudflared` gives the OpenAI-compatible API a temporary public `https://<words>.trycloudflare.com`
+ * address, so another Atomic Chat, an SDK or a coding agent can use this machine's models from
+ * anywhere. No account, no domain, a new URL on every start.
+ *
+ * Shape of the code:
+ *
+ *  - `RemoteAccessManager` is the state machine the control routes talk to. JavaScript gives it what
+ *    the Rust original needed a mutex for: nothing here awaits between reading the state and writing
+ *    it, so `start` and `stop` decide on a consistent view.
+ *  - One *supervisor* per run owns the child process. It waits for the tunnel to register, proves the
+ *    URL reaches this server before anybody sees it, then watches for the process to exit. A `run`
+ *    counter makes a supervisor that was overtaken (a stop timed out, the core is shutting down)
+ *    unable to write state any more.
+ *  - Every transition is pushed to clients as `remote-access:status`, because the URL arrives seconds
+ *    after the request that asked for it has answered.
+ *
+ * The API key is deliberately not a precondition: exposing the server without one is the user's
+ * call, made explicit by the frontend.
+ *
+ * PRIVACY: the tunnel URL is never logged.
+ *
+ * Ported from: src-tauri/src/core/server/remote_access/mod.rs (image-generation line, `767ff6350`).
+ * ADR 2026-09-17-the-core-owns-the-cloudflare-quick-tunnel.
+ */
+import { AtomicCoreError } from '../contracts/index.js';
+import type { RemoteAccessRefusal, RemoteAccessStatus } from '../contracts/index.js';
+import type { Prober } from './probe.js';
+import type { TunnelSpawner, TunnelTimings } from './process.js';
+import type { ServerEndpoint } from './status.js';
+/** The refusal of a start. `details` is the app's machine-readable reason, which its parser reads. */
+export declare function remoteAccessRefusal(reason: RemoteAccessRefusal): AtomicCoreError;
+/** Where the tunnel name is trusted while the tunnel is up (the listener's `DynamicTrustedHosts`). */
+export interface TunnelHosts {
+    setTunnelHost(host: string): void;
+    clearTunnelHost(): void;
+}
+export interface RemoteAccessManagerDeps {
+    spawner: TunnelSpawner;
+    prober: Prober;
+    timings?: Partial<TunnelTimings>;
+    /** The running public server; `undefined` while it is stopped or stopping. */
+    server: () => ServerEndpoint | undefined;
+    hosts: TunnelHosts;
+    emit: (status: RemoteAccessStatus) => void;
+    /** Crash recovery; a tunnel is simply not journalled without one. */
+    journal?: {
+        record(pid: number, exe: string): Promise<void>;
+        clear(): Promise<void>;
+    };
+    /**
+     * Run `hook` if this process exits while a tunnel may still be alive; returns how to unregister.
+     * The last line of defence, as `kill_on_drop` was: a public URL must not outlive its owner.
+     */
+    onProcessExit?: (hook: () => void) => () => void;
+    log?: (level: 'info' | 'warn', message: string) => void;
+}
+export declare class RemoteAccessManager {
+    private readonly deps;
+    private phase;
+    private url;
+    /** Identifies the supervisor allowed to write this state. */
+    private run;
+    /** Kept while the process may still be alive: for shutdown, and to retry a stop that was not confirmed. */
+    private tunnel;
+    private signalStop;
+    private supervisor;
+    private stopping;
+    private probe;
+    private removeExitHook;
+    private readonly timings;
+    constructor(deps: RemoteAccessManagerDeps);
+    status(): RemoteAccessStatus;
+    /**
+     * Computes the status and pushes it to clients. Also called when the public server starts or
+     * stops: `blockReason` and `canStart` follow the server, not only the tunnel.
+     */
+    announce(): RemoteAccessStatus;
+    /**
+     * Starts a tunnel and answers at once with `starting`; the rest is reported through events.
+     * Refuses with a machine-readable reason. Synchronous on purpose: the endpoint is read and the
+     * phase flipped with nothing in between.
+     */
+    start(): RemoteAccessStatus;
+    /**
+     * Stops the tunnel and answers once it is down (normally well under a second; up to the two
+     * grace periods when the process does not react). A stop already under way is joined, so whoever
+     * needs the tunnel gone — the public server, above all — can rely on the answer.
+     */
+    stop(): Promise<RemoteAccessStatus>;
+    private stopNow;
+    /**
+     * Synchronous teardown for a shutdown that cannot wait: signals only. Whatever the supervisor
+     * still does, it no longer owns the state.
+     */
+    killNow(): void;
+    private isCurrent;
+    private within;
+    private settleStopped;
+    private recordChild;
+    /** Flips `starting` to `online`. `false` means a stop got there first. */
+    private goOnline;
+    /**
+     * Ends the process and records how the run ended. An exit that cannot be confirmed overrides
+     * `outcome`: the truth is then "may still be running".
+     */
+    private endRun;
+    private supervise;
+}