@cliftonc/cfld 0.2.4 → 0.2.6

package/dist/cli.js

@@ -3,12 +3,12 @@
 // src/cli.ts
 import { parseArgs } from "util";
 import { readFileSync as readFileSync7, realpathSync } from "fs";
-import { dirname, join as join7 } from "path";
+import { dirname, join as join8 } from "path";
 import { fileURLToPath } from "url";
 import pc7 from "picocolors";
 
 // src/commands/run.ts
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/core/state-machine.ts
 import { existsSync as existsSync2 } from "fs";
@@ -392,6 +392,24 @@ function certHasZone(certPath) {
   const token = readCertToken(certPath);
   return Boolean(token?.zoneID);
 }
+async function certZoneName(certPath) {
+  const token = readCertToken(certPath);
+  if (!token?.zoneID || !token.apiToken) return void 0;
+  try {
+    const res = await fetch(
+      `https://api.cloudflare.com/client/v4/zones/${token.zoneID}`,
+      {
+        headers: { Authorization: `Bearer ${token.apiToken}` },
+        signal: AbortSignal.timeout(5e3)
+      }
+    );
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.result?.name?.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
 
 // src/core/cert-store.ts
 function ensureStoreDir() {
@@ -408,8 +426,19 @@ function listStoredZones() {
     return [];
   }
 }
+function storedZoneClaiming(certPath, except) {
+  const zoneID = readCertToken(certPath)?.zoneID;
+  if (!zoneID) return void 0;
+  return listStoredZones().find(
+    (z) => z !== except && readCertToken(certPathForZone(z))?.zoneID === zoneID
+  );
+}
 function resolveCert(zone) {
-  return storedCertForZone(zone) ?? (certExists(defaultCertPath()) ? defaultCertPath() : void 0);
+  const stored = storedCertForZone(zone);
+  if (stored) return stored;
+  const def = defaultCertPath();
+  if (!certExists(def) || storedZoneClaiming(def, zone)) return void 0;
+  return def;
 }
 function importCert(zone, fromPath = defaultCertPath()) {
   ensureStoreDir();
@@ -936,7 +965,8 @@ function colorLevel(level) {
 
 // src/commands/login.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync8 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync3, renameSync, rmSync } from "fs";
+import { join as join4 } from "path";
 
 // src/ui/prompts.ts
 async function clack() {
@@ -1031,23 +1061,73 @@ function normalizeZone(input) {
   return input.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
 }
 async function loginCommand(flags) {
-  const interactive = isInteractive();
   const haveCert = certExists(defaultCertPath());
+  let certPath = defaultCertPath();
   if (flags.reauth || !haveCert) {
-    await runLogin();
+    certPath = await runLogin();
   } else {
     info("A Cloudflare certificate already exists. Use --reauth to authorize another domain.");
   }
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
+  try {
+    if (!certHasZone(certPath)) {
+      printZeroZoneGuidance();
+      throw new CfldError(
+        "Logged in, but your account has no domain to authorize.",
+        "Add a domain (see above), then run `cfld login --reauth`."
+      );
+    }
+    const zone = await saveCert(flags.zone ? normalizeZone(flags.zone) : void 0, certPath);
+    done(`Saved cert for ${zone}. You're ready \u2014 run \`cfld\`.`);
+  } finally {
+    discardLoginCert(certPath);
+  }
+}
+async function runLogin() {
+  const bin = await resolveBinary();
+  const def = defaultCertPath();
+  const backup = existsSync8(def) ? `${def}.cfld-backup` : void 0;
+  if (backup) renameSync(def, backup);
+  try {
+    step("Opening your browser to authorize with Cloudflare (no API token needed)\u2026");
+    note("  Pick the domain you want to use. Waiting for you to finish\u2026");
+    await new Promise((resolve, reject) => {
+      const child = spawn4(bin, ["tunnel", "login"], { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("exit", (code) => {
+        if (code === 0 || existsSync8(def)) resolve();
+        else reject(new CfldError("Cloudflare login did not complete.", "Re-run `cfld login`."));
+      });
+    });
+    if (!existsSync8(def)) {
+      throw new CfldError(
+        "Login finished but no certificate was written.",
+        "Re-run `cfld login` and complete the browser step."
+      );
+    }
+    if (!backup) return def;
+    mkdirSync3(cfldDir(), { recursive: true });
+    const fresh = join4(cfldDir(), "login-cert.tmp");
+    copyFileSync2(def, fresh);
+    rmSync(def);
+    return fresh;
+  } finally {
+    if (backup) renameSync(backup, def);
+  }
+}
+function discardLoginCert(certPath) {
+  if (certPath !== defaultCertPath()) rmSync(certPath, { force: true });
+}
+async function saveCert(expected, certPath) {
+  const actual = await certZoneName(certPath);
+  if (expected && actual && actual !== expected) {
     throw new CfldError(
-      "Logged in, but your account has no domain to authorize.",
-      "Add a domain (see above), then run `cfld login --reauth`."
+      `You authorized ${actual} in the browser, not ${expected}.`,
+      `Run \`cfld login --reauth --zone ${expected}\` and pick ${expected} this time.`
     );
   }
-  let zone = flags.zone ? normalizeZone(flags.zone) : void 0;
+  let zone = expected ?? actual;
   if (!zone) {
-    if (!interactive) {
+    if (!isInteractive()) {
       throw new CfldError(
         "Pass --zone to record which domain this cert is for.",
         "e.g. `cfld login --zone example.com`"
@@ -1055,48 +1135,57 @@ async function loginCommand(flags) {
     }
     zone = normalizeZone(await askText("Which domain did you authorize?", "example.com"));
   }
-  importCert(zone);
-  done(`Saved cert for ${zone}. You're ready \u2014 run \`cfld\`.`);
-}
-async function runLogin() {
-  const bin = await resolveBinary();
-  step("Opening your browser to authorize with Cloudflare (no API token needed)\u2026");
-  note("  Pick the domain you want to use. Waiting for you to finish\u2026");
-  await new Promise((resolve, reject) => {
-    const child = spawn4(bin, ["tunnel", "login"], { stdio: "inherit" });
-    child.on("error", reject);
-    child.on("exit", (code) => {
-      if (code === 0 || existsSync8(defaultCertPath())) resolve();
-      else reject(new CfldError("Cloudflare login did not complete.", "Re-run `cfld login`."));
-    });
-  });
-  if (!existsSync8(defaultCertPath())) {
+  const clash = storedZoneClaiming(certPath, zone);
+  if (clash && !actual) {
     throw new CfldError(
-      "Login finished but no certificate was written.",
-      "Re-run `cfld login` and complete the browser step."
+      `That cert is for the same domain as your saved ${clash} cert, not ${zone}.`,
+      `Run \`cfld login --reauth --zone ${zone}\` and pick ${zone} in the browser.`
     );
   }
+  importCert(zone, certPath);
+  return zone;
 }
 async function ensureCert(zone, opts = { interactive: true }) {
-  const existing = resolveCert(zone);
-  if (existing) return existing;
+  const usable = await usableCert(zone);
+  if (usable) return usable;
   if (!opts.interactive) {
     throw new CfldError(
       `No Cloudflare certificate found for ${zone}.`,
-      "Run `cfld login` first (needs a browser), or set TUNNEL_ORIGIN_CERT."
+      `Run \`cfld login --reauth --zone ${zone}\` first (needs a browser), or set TUNNEL_ORIGIN_CERT.`
     );
   }
-  await runLogin();
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
-    throw new CfldError(
-      "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
-      "Add a domain (see above), then re-run. Or use `cfld --quick` for a throwaway URL now."
-    );
+  info(`No certificate for ${zone} yet \u2014 authorize it in the browser.`);
+  const fresh = await runLogin();
+  try {
+    if (!certHasZone(fresh)) {
+      printZeroZoneGuidance();
+      throw new CfldError(
+        "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
+        "Add a domain (see above), then re-run. Or use `cfld --quick` for a throwaway URL now."
+      );
+    }
+    await saveCert(zone, fresh);
+  } finally {
+    discardLoginCert(fresh);
   }
-  const stored = importCert(zone);
   info(`Saved cert for ${zone}.`);
-  return stored;
+  return certPathForZone(zone);
+}
+async function usableCert(zone) {
+  const stored = storedCertForZone(zone);
+  if (stored) {
+    if (!storedZoneClaiming(stored, zone)) return stored;
+    const actual2 = await certZoneName(stored);
+    if (!actual2 || actual2 === zone) return stored;
+    warn(`The saved cert for ${zone} is actually for ${actual2} \u2014 discarding it.`);
+    rmSync(stored);
+  }
+  const def = defaultCertPath();
+  if (!certHasZone(def)) return void 0;
+  const actual = await certZoneName(def);
+  if (actual === zone) return importCert(zone, def);
+  if (!actual && !storedZoneClaiming(def, zone)) return def;
+  return void 0;
 }
 function printZeroZoneGuidance() {
   warn("cfld can't create a permanent custom URL yet \u2014 your account has no domains.");
@@ -1123,11 +1212,11 @@ function printZeroZoneGuidance() {
 
 // src/util/gitignore.ts
 import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function ensureGitignored(cwd, pattern) {
-  const gitignorePath = join4(cwd, ".gitignore");
+  const gitignorePath = join5(cwd, ".gitignore");
   const hasGitignore = existsSync9(gitignorePath);
-  const inRepo = hasGitignore || existsSync9(join4(cwd, ".git"));
+  const inRepo = hasGitignore || existsSync9(join5(cwd, ".git"));
   if (!inRepo) return false;
   const existing = hasGitignore ? readFileSync6(gitignorePath, "utf8") : "";
   const present = existing.split("\n").map((l) => l.trim()).includes(pattern);
@@ -1206,23 +1295,15 @@ async function launch(ctx) {
   const target = `localhost:${ctx.port}`;
   const interactive = isInteractive() && !ctx.noUi;
   let dashboard;
-  if (interactive) {
-    const { startDashboard } = await import("./dashboard-GA37Z4H4.js");
-    dashboard = startDashboard({
-      url,
-      target,
-      tunnelName: ctx.tunnelName,
-      status: "connecting",
-      connections: 0,
-      requests: 0,
-      split: Boolean(ctx.exec),
-      devLabel: ctx.exec ? describeCommand(ctx.exec) : void 0,
-      tunnelLogs: [],
-      devLogs: []
-    });
-  } else {
-    step("Setting up your tunnel\u2026");
-  }
+  let runner;
+  let child;
+  let result;
+  let poll;
+  let metricsPort = 0;
+  let shuttingDown = false;
+  let started = false;
+  let busy = false;
+  const childAbort = new AbortController();
   const setupStep = (s) => dashboard ? dashboard.log(s, "tunnel") : step(s);
   const setupDone = (s) => dashboard ? dashboard.log(s, "tunnel") : done(s);
   const emitLine = (line) => {
@@ -1236,11 +1317,6 @@ async function launch(ctx) {
     if (dashboard) dashboard.log(line, "dev");
     else process.stderr.write(line + "\n");
   };
-  let runner;
-  let child;
-  let poll;
-  let shuttingDown = false;
-  const childAbort = new AbortController();
   const shutdown = (opts = {}) => {
     if (shuttingDown) return;
     shuttingDown = true;
@@ -1253,6 +1329,65 @@ ${opts.reason}`);
     if (child) reapChild(child).then(finish, finish);
     else finish();
   };
+  const startTunnel = (port) => startRunner({
+    configPath: result.configPath,
+    tunnelName: result.tunnelName,
+    certPath: result.certPath,
+    metricsPort: port,
+    onLine: (line) => emitLine(line),
+    onStatus: (status) => {
+      if (status === "reconnecting") dashboard?.update({ status: "reconnecting" });
+      else if (status === "connecting" && !dashboard) note("Reconnecting\u2026");
+    },
+    onFatal: (message) => {
+      warn(message);
+      shutdown({ code: 1 });
+    }
+  });
+  const startDevServer = () => startChild({
+    command: ctx.exec,
+    cwd: ctx.cwd,
+    env: ctx.noEnv ? void 0 : { [ctx.envKey]: url },
+    onLine: (line) => emitDevLine(line),
+    onExit: (code, signal) => {
+      childAbort.abort();
+      const how = code !== null ? `exited (code ${code})` : `was terminated${signal ? ` (${signal})` : ""}`;
+      shutdown({
+        reason: `Your dev command ${how} \u2014 stopping. Your tunnel URL is preserved.`,
+        code: code ?? 1
+      });
+    }
+  });
+  const doRestartDev = async () => {
+    if (!ctx.exec || !child) return;
+    dashboard?.log("\u21BB restarting dev server\u2026", "dev");
+    await reapChild(child);
+    if (shuttingDown) return;
+    child = startDevServer();
+  };
+  const doRestartTunnel = async () => {
+    if (!runner || !result) return;
+    dashboard?.log("\u21BB restarting tunnel\u2026", "tunnel");
+    dashboard?.update({ status: "reconnecting" });
+    runner.stop();
+    metricsPort = await findFreePort();
+    runner = await startTunnel(metricsPort);
+    const r = await waitForReady(metricsPort).catch(() => void 0);
+    if (r && !shuttingDown) dashboard?.update({ status: "live", connections: r.connections });
+  };
+  const guard = (fn) => () => {
+    if (busy || shuttingDown || !started) return;
+    busy = true;
+    void Promise.resolve(fn()).finally(() => {
+      busy = false;
+    });
+  };
+  const restartDev = guard(doRestartDev);
+  const restartTunnel = guard(doRestartTunnel);
+  const restartAll = guard(async () => {
+    await doRestartTunnel();
+    await doRestartDev();
+  });
   process.once(
     "SIGINT",
     () => shutdown({ reason: "Stopping \u2014 your URL is preserved. Re-run `cfld`." })
@@ -1262,24 +1397,35 @@ ${opts.reason}`);
     () => shutdown({ reason: "Stopping \u2014 your URL is preserved." })
   );
   process.once("SIGHUP", () => shutdown({ reason: "Terminal closed \u2014 stopping." }));
+  if (interactive) {
+    const { startDashboard } = await import("./dashboard-Z4AN7H5V.js");
+    dashboard = startDashboard(
+      {
+        url,
+        target,
+        tunnelName: ctx.tunnelName,
+        status: "connecting",
+        connections: 0,
+        requests: 0,
+        split: Boolean(ctx.exec),
+        devLabel: ctx.exec ? describeCommand(ctx.exec) : void 0,
+        tunnelLogs: [],
+        devLogs: []
+      },
+      {
+        restartAll,
+        restartTunnel,
+        restartDev: ctx.exec ? restartDev : void 0
+      }
+    );
+  } else {
+    step("Setting up your tunnel\u2026");
+  }
   if (ctx.exec) {
     if (!dashboard) step(`Starting \`${describeCommand(ctx.exec)}\`\u2026`);
-    child = startChild({
-      command: ctx.exec,
-      cwd: ctx.cwd,
-      env: ctx.noEnv ? void 0 : { [ctx.envKey]: url },
-      onLine: (line) => emitDevLine(line),
-      onExit: (code, signal) => {
-        childAbort.abort();
-        const how = code !== null ? `exited (code ${code})` : `was terminated${signal ? ` (${signal})` : ""}`;
-        shutdown({
-          reason: `Your dev command ${how} \u2014 stopping. Your tunnel URL is preserved.`,
-          code: code ?? 1
-        });
-      }
-    });
+    child = startDevServer();
   }
-  const result = await ctx.runReconcile({
+  result = await ctx.runReconcile({
     onStep: (s) => setupStep(s),
     confirmOverwrite: interactive ? (h, t) => {
       const ask = () => askConfirm(`${h} already points to ${t}. Repoint it to this tunnel?`);
@@ -1299,22 +1445,8 @@ ${opts.reason}`);
     result,
     (msg) => dashboard ? dashboard.log(msg, "tunnel") : info(msg)
   );
-  const metricsPort = await findFreePort();
-  runner = await startRunner({
-    configPath: result.configPath,
-    tunnelName: result.tunnelName,
-    certPath: result.certPath,
-    metricsPort,
-    onLine: (line) => emitLine(line),
-    onStatus: (status) => {
-      if (status === "reconnecting") dashboard?.update({ status: "reconnecting" });
-      else if (status === "connecting" && !dashboard) note("Reconnecting\u2026");
-    },
-    onFatal: (message) => {
-      warn(message);
-      shutdown({ code: 1 });
-    }
-  });
+  metricsPort = await findFreePort();
+  runner = await startTunnel(metricsPort);
   const ready = await waitForReady(metricsPort).catch((err) => {
     child?.stop();
     runner?.stop();
@@ -1324,6 +1456,7 @@ ${opts.reason}`);
       err instanceof Error ? err.message : void 0
     );
   });
+  started = true;
   if (child && !shuttingDown) {
     if (dashboard) dashboard.update({ status: "waiting", connections: ready.connections });
     else step(`Waiting for your dev server on :${ctx.port}\u2026`);
@@ -1332,7 +1465,7 @@ ${opts.reason}`);
     if (!up) warn(`Nothing is listening on :${ctx.port} yet \u2014 going live anyway.`);
   }
   if (!ctx.noEnv) {
-    const { changed } = upsertEnv(join5(ctx.cwd, ".env"), ctx.envKey, url);
+    const { changed } = upsertEnv(join6(ctx.cwd, ".env"), ctx.envKey, url);
     if (changed && !dashboard) info(`Wrote ${ctx.envKey}=${url} to .env`);
   }
   if (dashboard) {
@@ -1509,7 +1642,7 @@ ${opts.reason ?? "Stopped ephemeral tunnel."}`);
     });
   }
   if (interactive) {
-    const { startDashboard } = await import("./dashboard-GA37Z4H4.js");
+    const { startDashboard } = await import("./dashboard-Z4AN7H5V.js");
     dashboard = startDashboard({
       url,
       target,
@@ -1709,20 +1842,26 @@ async function setupCommand(flags) {
     );
     return;
   }
-  await runLogin();
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
-    if (await askConfirm("Start a temporary quick tunnel now instead?")) {
-      await quickCommand(flags);
-      return;
+  const fresh = await runLogin();
+  let zone;
+  try {
+    if (!certHasZone(fresh)) {
+      printZeroZoneGuidance();
+      if (await askConfirm("Start a temporary quick tunnel now instead?")) {
+        await quickCommand(flags);
+        return;
+      }
+      throw new CfldError(
+        "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
+        "Add a domain (see above), then run `cfld setup` again."
+      );
     }
-    throw new CfldError(
-      "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
-      "Add a domain (see above), then run `cfld setup` again."
-    );
+    const detected = await certZoneName(fresh);
+    zone = await saveCert(detected ?? await askAuthorizedZone(knownZones), fresh);
+  } finally {
+    discardLoginCert(fresh);
   }
-  const zone = await askAuthorizedZone(knownZones);
-  const certPath = importCert(zone);
+  const certPath = certPathForZone(zone);
   info(`Saved cert for ${zone}.`);
   await configureProject(flags, { zone, certPath, cwd });
   await offerGoLive(flags, zone);
@@ -1953,9 +2092,9 @@ function resolveCurrentEntry2() {
 import pc5 from "picocolors";
 
 // src/core/service.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function serviceSlug(name) {
   return name.replace(/^cfld-/, "");
 }
@@ -1963,16 +2102,16 @@ function launchAgentLabel(name) {
   return `com.cfld.${serviceSlug(name)}`;
 }
 function launchAgentPath(name) {
-  return join6(homedir2(), "Library", "LaunchAgents", `${launchAgentLabel(name)}.plist`);
+  return join7(homedir2(), "Library", "LaunchAgents", `${launchAgentLabel(name)}.plist`);
 }
 function systemdUnitName(name) {
   return `cfld-${serviceSlug(name)}.service`;
 }
 function systemdUnitPath(name) {
-  return join6(homedir2(), ".config", "systemd", "user", systemdUnitName(name));
+  return join7(homedir2(), ".config", "systemd", "user", systemdUnitName(name));
 }
 function logDir() {
-  return join6(cfldDir(), "logs");
+  return join7(cfldDir(), "logs");
 }
 function renderLaunchAgent(spec) {
   const args = [
@@ -1986,8 +2125,8 @@ function renderLaunchAgent(spec) {
     spec.name
   ];
   const argsXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
-  const out = join6(logDir(), `${serviceSlug(spec.name)}.out.log`);
-  const err = join6(logDir(), `${serviceSlug(spec.name)}.err.log`);
+  const out = join7(logDir(), `${serviceSlug(spec.name)}.out.log`);
+  const err = join7(logDir(), `${serviceSlug(spec.name)}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -2052,10 +2191,10 @@ function assertSupported() {
 }
 async function installService(spec) {
   const p = assertSupported();
-  mkdirSync3(logDir(), { recursive: true });
+  mkdirSync4(logDir(), { recursive: true });
   if (p === "darwin") {
     const path = launchAgentPath(spec.name);
-    mkdirSync3(join6(homedir2(), "Library", "LaunchAgents"), { recursive: true });
+    mkdirSync4(join7(homedir2(), "Library", "LaunchAgents"), { recursive: true });
     writeFileSync6(path, renderLaunchAgent(spec), "utf8");
     await exec("launchctl", ["unload", path]);
     const res = await exec("launchctl", ["load", "-w", path]);
@@ -2067,7 +2206,7 @@ async function installService(spec) {
     }
   } else {
     const path = systemdUnitPath(spec.name);
-    mkdirSync3(join6(homedir2(), ".config", "systemd", "user"), { recursive: true });
+    mkdirSync4(join7(homedir2(), ".config", "systemd", "user"), { recursive: true });
     writeFileSync6(path, renderSystemdUnit(spec), "utf8");
     await exec("systemctl", ["--user", "daemon-reload"]);
     const res = await exec("systemctl", [
@@ -2090,13 +2229,13 @@ async function uninstallService(name) {
     const path = launchAgentPath(name);
     if (existsSync10(path)) {
       await exec("launchctl", ["unload", "-w", path]);
-      rmSync(path, { force: true });
+      rmSync2(path, { force: true });
     }
   } else {
     const unit = systemdUnitName(name);
     await exec("systemctl", ["--user", "disable", "--now", unit]);
     const path = systemdUnitPath(name);
-    if (existsSync10(path)) rmSync(path, { force: true });
+    if (existsSync10(path)) rmSync2(path, { force: true });
     await exec("systemctl", ["--user", "daemon-reload"]);
   }
 }
@@ -2216,6 +2355,14 @@ async function doctorCommand() {
   const zones = listStoredZones();
   if (zones.length) out(`  ${ok} cert store: ${zones.join(", ")}`);
   else out(`  ${pc6.dim("\xB7")} cert store empty`);
+  for (const zone of zones) {
+    const actual = await certZoneName(certPathForZone(zone));
+    if (actual && actual !== zone) {
+      out(
+        `  ${bad} ${zone}.pem is really a cert for ${actual} \u2014 fix with \`cfld login --reauth --zone ${zone}\``
+      );
+    }
+  }
   const entries = listEntries();
   out(`  ${ok} registry: ${entries.length} tunnel(s)`);
   out("");
@@ -2225,7 +2372,7 @@ async function doctorCommand() {
 function readVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync7(join7(here, "../package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join8(here, "../package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
     return "0.0.0";

package/dist/dashboard-Z4AN7H5V.js

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+
+// src/ui/dashboard.tsx
+import { spawn } from "child_process";
+import "react";
+import { Box, render, Text, useApp, useInput } from "ink";
+import { jsx, jsxs } from "react/jsx-runtime";
+var VIEW_ORDER = ["dev", "split", "tunnel"];
+var MAX_BUFFER = 1e3;
+var HEADER_ROWS = 5;
+function statusDot(status) {
+  switch (status) {
+    case "live":
+      return /* @__PURE__ */ jsx(Text, { color: "green", children: "\u25CF LIVE" });
+    case "waiting":
+      return /* @__PURE__ */ jsx(Text, { color: "yellow", children: "\u25CC WAITING" });
+    case "reconnecting":
+      return /* @__PURE__ */ jsx(Text, { color: "yellow", children: "\u25CC RECONNECTING" });
+    default:
+      return /* @__PURE__ */ jsx(Text, { color: "cyan", children: "\u25CC CONNECTING" });
+  }
+}
+function hotkeyHints(state) {
+  const dev = Boolean(state.split);
+  const row1 = state.canRestart ? "r restart all" : "";
+  const row2 = state.canRestart ? dev ? "d restart dev \xB7 t restart tunnel" : "t restart tunnel" : "";
+  const row3 = [dev ? "\u2039 \u203A cols" : "", "o open", "^C quit"].filter(Boolean).join(" \xB7 ");
+  return [row1, row2, row3];
+}
+function Header(state) {
+  const latency = state.avgLatencyMs !== void 0 ? `  \u26A1 ${state.avgLatencyMs}ms avg` : "";
+  const [h1, h2, h3] = hotkeyHints(state);
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [
+    /* @__PURE__ */ jsxs(Box, { justifyContent: "space-between", children: [
+      /* @__PURE__ */ jsxs(Box, { children: [
+        statusDot(state.status),
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsx(Text, { color: "cyan", bold: true, children: state.url })
+      ] }),
+      h1 ? /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "  ",
+        h1
+      ] }) : null
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { justifyContent: "space-between", children: [
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "\u2192 ",
+        state.target,
+        "   ",
+        state.connections,
+        " edge conns",
+        state.ephemeral ? " \xB7 ephemeral" : ""
+      ] }),
+      h2 ? /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "  ",
+        h2
+      ] }) : null
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { justifyContent: "space-between", children: [
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "\u2191 ",
+        state.requests,
+        " reqs",
+        latency
+      ] }),
+      h3 ? /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "  ",
+        h3
+      ] }) : null
+    ] })
+  ] });
+}
+function LogColumn({
+  title,
+  titleColor,
+  lines,
+  rows,
+  placeholder,
+  divider
+}) {
+  return /* @__PURE__ */ jsxs(
+    Box,
+    {
+      flexDirection: "column",
+      flexGrow: 1,
+      flexShrink: 1,
+      flexBasis: 0,
+      paddingLeft: divider ? 1 : 0,
+      borderStyle: divider ? "single" : void 0,
+      borderColor: "gray",
+      borderTop: false,
+      borderBottom: false,
+      borderRight: false,
+      borderLeft: Boolean(divider),
+      children: [
+        title ? /* @__PURE__ */ jsx(Text, { color: titleColor, bold: true, wrap: "truncate-end", children: title }) : null,
+        /* @__PURE__ */ jsx(Box, { flexDirection: "column", flexGrow: 1, justifyContent: "flex-end", overflow: "hidden", children: lines.length === 0 ? /* @__PURE__ */ jsx(Text, { dimColor: true, children: placeholder }) : (
+          // Wrap rather than truncate so long lines (e.g. magic-link / OAuth
+          // URLs) stay fully visible and selectable instead of ending in "…".
+          // The bottom-pinned box clips older wrapped lines off the top.
+          lines.slice(-rows).map((line, i) => /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: line }, i))
+        ) })
+      ]
+    }
+  );
+}
+function Dashboard(state) {
+  const termRows = process.stdout.rows || 24;
+  const view = state.split ? state.view ?? "split" : "tunnel";
+  const titleRows = state.split ? 1 : 0;
+  const logRows = Math.max(3, termRows - HEADER_ROWS - titleRows - 1);
+  const devColumn = (divider) => /* @__PURE__ */ jsx(
+    LogColumn,
+    {
+      title: state.devLabel ?? "dev server",
+      titleColor: "cyan",
+      lines: state.devLogs,
+      rows: logRows,
+      placeholder: "waiting for dev-server output\u2026",
+      divider
+    }
+  );
+  const tunnelColumn = (divider) => /* @__PURE__ */ jsx(
+    LogColumn,
+    {
+      title: state.split ? "tunnel" : void 0,
+      titleColor: "blue",
+      lines: state.tunnelLogs,
+      rows: logRows,
+      placeholder: state.split ? "waiting for tunnel activity\u2026" : state.ephemeral ? "waiting for traffic\u2026 (Ctrl-C stops; this URL is temporary)" : "waiting for traffic\u2026 (Ctrl-C stops; your URL is preserved)",
+      divider
+    }
+  );
+  let body;
+  if (view === "split") {
+    body = /* @__PURE__ */ jsxs(Box, { flexGrow: 1, flexDirection: "row", paddingX: 1, paddingTop: 1, children: [
+      devColumn(),
+      tunnelColumn(true)
+    ] });
+  } else {
+    body = /* @__PURE__ */ jsx(Box, { flexGrow: 1, paddingX: 1, paddingTop: 1, children: view === "dev" ? devColumn() : tunnelColumn() });
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", height: termRows, overflow: "hidden", children: [
+    /* @__PURE__ */ jsx(Header, { ...state }),
+    body
+  ] });
+}
+function App({
+  state,
+  actions,
+  onCycleView,
+  onOpen
+}) {
+  const { exit } = useApp();
+  useInput((input, key) => {
+    if (key.leftArrow || input === "<" || input === ",") return onCycleView(-1);
+    if (key.rightArrow || input === ">" || input === ".") return onCycleView(1);
+    switch (input.toLowerCase()) {
+      case "r":
+        return actions.restartAll?.();
+      case "d":
+        return actions.restartDev?.();
+      case "t":
+        return actions.restartTunnel?.();
+      case "o":
+        return onOpen();
+      case "q":
+        return exit();
+    }
+  });
+  return /* @__PURE__ */ jsx(Dashboard, { ...state });
+}
+function openInBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn(cmd, [url], {
+      stdio: "ignore",
+      detached: true,
+      shell: process.platform === "win32"
+    }).unref();
+  } catch {
+  }
+}
+var ENTER_ALT_SCREEN = "\x1B[?1049h";
+var LEAVE_ALT_SCREEN = "\x1B[?1049l";
+function startDashboard(initial, actions = {}) {
+  const state = {
+    ...initial,
+    view: initial.view ?? (initial.split ? "split" : "tunnel"),
+    canRestart: Boolean(actions.restartAll || actions.restartTunnel),
+    tunnelLogs: [...initial.tunnelLogs],
+    devLogs: [...initial.devLogs]
+  };
+  const cycleView = (delta) => {
+    if (!state.split) return;
+    const i = VIEW_ORDER.indexOf(state.view ?? "split");
+    const next = VIEW_ORDER[Math.min(VIEW_ORDER.length - 1, Math.max(0, i + delta))];
+    if (next !== state.view) {
+      state.view = next;
+      rerender();
+    }
+  };
+  const element = () => /* @__PURE__ */ jsx(
+    App,
+    {
+      state,
+      actions,
+      onCycleView: cycleView,
+      onOpen: () => openInBrowser(state.url)
+    }
+  );
+  const mount = () => render(element(), {
+    stdout: process.stdout,
+    // We drive graceful shutdown ourselves; ink's Ctrl-C simply resolves
+    // waitUntilExit, and the caller then stops the runner (preserving state).
+    exitOnCtrlC: true
+  });
+  process.stdout.write(ENTER_ALT_SCREEN);
+  let instance = mount();
+  let paused = false;
+  const rerender = () => {
+    if (!paused) instance.rerender(element());
+  };
+  let altActive = true;
+  const leaveAltScreen = () => {
+    if (!altActive) return;
+    altActive = false;
+    process.stdout.write(LEAVE_ALT_SCREEN);
+  };
+  const onResize = () => {
+    if (paused) return;
+    instance.clear();
+    rerender();
+  };
+  process.stdout.on("resize", onResize);
+  process.once("exit", leaveAltScreen);
+  return {
+    update(partial) {
+      Object.assign(state, partial);
+      rerender();
+    },
+    log(line, source = "tunnel") {
+      if (source === "dev") {
+        state.devLogs = [...state.devLogs, line].slice(-MAX_BUFFER);
+      } else {
+        state.tunnelLogs = [...state.tunnelLogs, line].slice(-MAX_BUFFER);
+      }
+      rerender();
+    },
+    async suspend(fn) {
+      paused = true;
+      instance.unmount();
+      leaveAltScreen();
+      try {
+        return await fn();
+      } finally {
+        process.stdout.write(ENTER_ALT_SCREEN);
+        altActive = true;
+        instance = mount();
+        paused = false;
+        rerender();
+      }
+    },
+    waitUntilExit() {
+      return instance.waitUntilExit();
+    },
+    stop() {
+      process.stdout.off("resize", onResize);
+      process.removeListener("exit", leaveAltScreen);
+      instance.unmount();
+      leaveAltScreen();
+    }
+  };
+}
+export {
+  startDashboard
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cliftonc/cfld",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Zero-token, persistent Cloudflare tunnel CLI for local dev — same public HTTPS URL every run.",
   "type": "module",
   "bin": {

package/dist/dashboard-GA37Z4H4.js

@@ -1,194 +0,0 @@
-#!/usr/bin/env node
-
-// src/ui/dashboard.tsx
-import "react";
-import { Box, render, Text } from "ink";
-import { jsx, jsxs } from "react/jsx-runtime";
-var MAX_BUFFER = 1e3;
-var HEADER_ROWS = 5;
-function statusDot(status) {
-  switch (status) {
-    case "live":
-      return /* @__PURE__ */ jsx(Text, { color: "green", children: "\u25CF LIVE" });
-    case "waiting":
-      return /* @__PURE__ */ jsx(Text, { color: "yellow", children: "\u25CC WAITING" });
-    case "reconnecting":
-      return /* @__PURE__ */ jsx(Text, { color: "yellow", children: "\u25CC RECONNECTING" });
-    default:
-      return /* @__PURE__ */ jsx(Text, { color: "cyan", children: "\u25CC CONNECTING" });
-  }
-}
-function Header(state) {
-  const latency = state.avgLatencyMs !== void 0 ? `  \u26A1 ${state.avgLatencyMs}ms avg` : "";
-  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [
-    /* @__PURE__ */ jsxs(Box, { children: [
-      statusDot(state.status),
-      /* @__PURE__ */ jsx(Text, { children: " " }),
-      /* @__PURE__ */ jsx(Text, { color: "cyan", bold: true, children: state.url })
-    ] }),
-    /* @__PURE__ */ jsxs(Box, { children: [
-      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
-        "\u2192 ",
-        state.target
-      ] }),
-      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
-        "   ",
-        state.connections,
-        " edge conns"
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs(Box, { children: [
-      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
-        "\u2191 ",
-        state.requests,
-        " reqs",
-        latency
-      ] }),
-      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
-        "   ",
-        state.ephemeral ? "ephemeral \xB7 Ctrl-C stops" : "Ctrl-C stops \xB7 URL preserved"
-      ] })
-    ] })
-  ] });
-}
-function LogColumn({
-  title,
-  titleColor,
-  lines,
-  rows,
-  placeholder,
-  divider
-}) {
-  return /* @__PURE__ */ jsxs(
-    Box,
-    {
-      flexDirection: "column",
-      flexGrow: 1,
-      flexShrink: 1,
-      flexBasis: 0,
-      paddingLeft: divider ? 1 : 0,
-      borderStyle: divider ? "single" : void 0,
-      borderColor: "gray",
-      borderTop: false,
-      borderBottom: false,
-      borderRight: false,
-      borderLeft: Boolean(divider),
-      children: [
-        title ? /* @__PURE__ */ jsx(Text, { color: titleColor, bold: true, wrap: "truncate-end", children: title }) : null,
-        /* @__PURE__ */ jsx(Box, { flexDirection: "column", flexGrow: 1, justifyContent: "flex-end", overflow: "hidden", children: lines.length === 0 ? /* @__PURE__ */ jsx(Text, { dimColor: true, children: placeholder }) : lines.slice(-rows).map((line, i) => /* @__PURE__ */ jsx(Text, { wrap: "truncate-end", children: line }, i)) })
-      ]
-    }
-  );
-}
-function Dashboard(state) {
-  const termRows = process.stdout.rows || 24;
-  const titleRows = state.split ? 1 : 0;
-  const logRows = Math.max(3, termRows - HEADER_ROWS - titleRows - 1);
-  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", height: termRows, overflow: "hidden", children: [
-    /* @__PURE__ */ jsx(Header, { ...state }),
-    state.split ? /* @__PURE__ */ jsxs(Box, { flexGrow: 1, flexDirection: "row", paddingX: 1, paddingTop: 1, children: [
-      /* @__PURE__ */ jsx(
-        LogColumn,
-        {
-          title: state.devLabel ?? "dev server",
-          titleColor: "cyan",
-          lines: state.devLogs,
-          rows: logRows,
-          placeholder: "waiting for dev-server output\u2026"
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        LogColumn,
-        {
-          title: "tunnel",
-          titleColor: "blue",
-          lines: state.tunnelLogs,
-          rows: logRows,
-          placeholder: "waiting for tunnel activity\u2026",
-          divider: true
-        }
-      )
-    ] }) : /* @__PURE__ */ jsx(Box, { flexGrow: 1, paddingX: 1, paddingTop: 1, children: /* @__PURE__ */ jsx(
-      LogColumn,
-      {
-        lines: state.tunnelLogs,
-        rows: logRows,
-        placeholder: state.ephemeral ? "waiting for traffic\u2026 (Ctrl-C stops; this URL is temporary)" : "waiting for traffic\u2026 (Ctrl-C stops; your URL is preserved)"
-      }
-    ) })
-  ] });
-}
-var ENTER_ALT_SCREEN = "\x1B[?1049h";
-var LEAVE_ALT_SCREEN = "\x1B[?1049l";
-function startDashboard(initial) {
-  const state = {
-    ...initial,
-    tunnelLogs: [...initial.tunnelLogs],
-    devLogs: [...initial.devLogs]
-  };
-  const mount = () => render(/* @__PURE__ */ jsx(Dashboard, { ...state }), {
-    stdout: process.stdout,
-    // We drive graceful shutdown ourselves; ink's Ctrl-C simply resolves
-    // waitUntilExit, and the caller then stops the runner (preserving state).
-    exitOnCtrlC: true
-  });
-  process.stdout.write(ENTER_ALT_SCREEN);
-  let instance = mount();
-  let paused = false;
-  const rerender = () => {
-    if (!paused) instance.rerender(/* @__PURE__ */ jsx(Dashboard, { ...state }));
-  };
-  let altActive = true;
-  const leaveAltScreen = () => {
-    if (!altActive) return;
-    altActive = false;
-    process.stdout.write(LEAVE_ALT_SCREEN);
-  };
-  const onResize = () => {
-    if (paused) return;
-    instance.clear();
-    rerender();
-  };
-  process.stdout.on("resize", onResize);
-  process.once("exit", leaveAltScreen);
-  return {
-    update(partial) {
-      Object.assign(state, partial);
-      rerender();
-    },
-    log(line, source = "tunnel") {
-      if (source === "dev") {
-        state.devLogs = [...state.devLogs, line].slice(-MAX_BUFFER);
-      } else {
-        state.tunnelLogs = [...state.tunnelLogs, line].slice(-MAX_BUFFER);
-      }
-      rerender();
-    },
-    async suspend(fn) {
-      paused = true;
-      instance.unmount();
-      leaveAltScreen();
-      try {
-        return await fn();
-      } finally {
-        process.stdout.write(ENTER_ALT_SCREEN);
-        altActive = true;
-        instance = mount();
-        paused = false;
-        rerender();
-      }
-    },
-    waitUntilExit() {
-      return instance.waitUntilExit();
-    },
-    stop() {
-      process.stdout.off("resize", onResize);
-      process.removeListener("exit", leaveAltScreen);
-      instance.unmount();
-      leaveAltScreen();
-    }
-  };
-}
-export {
-  startDashboard
-};