@dylanpiercey/work 0.0.223 → 0.1.1

package/README.md

@@ -44,12 +44,6 @@ offers the agent CLIs, and runs `pnpm install`:
 
 ```sh
 pnpm dev                  # http://localhost:7171
-```
-
-For a production build plus a background service (systemd on Linux, launchd on macOS):
-
-```sh
-./scripts/setup-prod.sh   # build + install + start the service
 
 # While hacking on work itself, point the background service at a checkout
 # (and back at the npm install when done):
@@ -58,8 +52,6 @@ work-source local          # this tree (or: work-source local /path/to/work)
 work-source rebuild        # rebuild + restart without rewriting the unit
 work-source prod           # global @dylanpiercey/work again
 work-source                # status
-./scripts/run-prod.sh     # or: build with --no-service and run manually
-./scripts/update.sh       # later: pull latest, rebuild, restart
 ```
 
 ### Access
@@ -85,18 +77,28 @@ Access, `tailscale serve` — and tell work about it:
 Set them when installing (`WORK_ALLOWED_HOSTS=… WORK_TRUSTED_PROXIES=…
 WORK_LISTEN=0.0.0.0 work setup`); `work setup` keeps them in the service
 from then on. A refused request gets a page saying which setting it needs.
-Installs from before this default keep listening on every interface, and
-other machines see that page until they are configured. Everything (pages,
-API, and the `/term` websockets) serves from the single app port, so route
-the whole hostname to it.
+Everything (pages, API, and the `/term` websockets) serves from the single
+app port, so route the whole hostname to it.
+
+**Tailscale** is the zero-config way. On a machine logged in to Tailscale
+(1.52 or newer), `work setup` offers to run `tailscale serve --bg <port>`,
+which puts work at `https://<machine>.<tailnet>.ts.net/` for your devices on
+the tailnet alone (never Funnel, which would publish it to the internet),
+and adds that name to `WORK_ALLOWED_HOSTS`: open it on a phone signed in to
+the same tailnet. `work setup --tailscale` does it without asking and
+`--no-tailscale` skips the question; `--yes` alone leaves Tailscale's config
+as it is. A serve config already pointing at work only has its name
+allowed, and `work doctor` says which of these holds.
 
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
-directly. Through a tunnel, route a wildcard hostname to the app port as
-well and work proxies it — HTTP and websockets, so HMR works — to
-`localhost:<port>`. `WORK_PORT_HOSTS` picks the hostname shape the chips
-link to; `sub` is always accepted, `dash` only when picked, and only for a
-name of three labels or more:
+directly — under a tailnet name too, since `tailscale serve` has no
+wildcard names: there a chip reaches a dev server that listens beyond
+loopback (`--host`), and one on loopback says so. Through a tunnel, route
+a wildcard hostname to the app port as well and work proxies it — HTTP and
+websockets, so HMR works — to `localhost:<port>`. `WORK_PORT_HOSTS` picks
+the hostname shape the chips link to; `sub` is always accepted, `dash` only
+when picked, and only for a name of three labels or more:
 
 - `sub` (default): `https://3000.work.example.com`. Needs a wildcard
   `*.work.example.com` route and a certificate that covers it (your own
@@ -114,11 +116,6 @@ auth as the app. API writes and the terminal websockets refuse a foreign
 `Origin`, so a page a workspace serves cannot drive work with the shared
 login cookie.
 
-> **Upgrading from the two-port layout:** older setups routed `/term/*` to a
-> separate terminal port (7172). That port no longer exists — remove the
-> `/term` rule from your tunnel/proxy config and send all traffic to the app
-> port, or terminals will fail to connect.
-
 ## Backup, restore, join
 
 A `work` machine holds almost nothing that lives only there: branches are
@@ -163,16 +160,6 @@ targeting that branch.
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                             |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts       |
 
-Ports and paths can be exported before `scripts/setup-prod.sh` to bake them into
-the service. For settings that should outlive an update, put them in an untracked
-`.env.local` at the repo root instead — `scripts/run-prod.sh` reads it on every
-start (the dev server does not), only `WORK_*` names apply, and the
-surrounding environment still takes precedence:
-
-```sh
-WORK_BRANCH_PREFIX=rturnq
-```
-
 The usage panel (and `work usage`) reads plan/quota windows straight from each
 agent CLI's own credentials on disk — Claude, Codex, Cursor, Grok, and Copilot
 (via `gh`'s token). Providers you are not signed into simply say so.

package/bin/work.mjs

@@ -2,6 +2,8 @@
 // work CLI — ships with the npm package (no dependencies; plain node).
 //
 //   work setup    install missing tools, sign in, install/refresh the background service
+//                 (--tailscale serves work on the tailnet with `tailscale serve`, which
+//                 it otherwise offers when Tailscale is logged in; --no-tailscale skips that)
 //   work doctor   report machine readiness (--json, --fix to install what's missing)
 //   work start    run the server in the foreground
 //   work update   upgrade the npm package and refresh the service
@@ -26,9 +28,19 @@ import { execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import readline from "node:readline/promises";
+import tty from "node:tty";
 import { fileURLToPath } from "node:url";
-import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
-import { installTool } from "../lib/setup/install.mjs";
+import {
+  doctor,
+  formatDoctor,
+  setupPath,
+  tailscaleProbe,
+  which,
+} from "../lib/setup/doctor.mjs";
+import { allowHost, stateText } from "../lib/setup/tailscale.mjs";
+import { installTool, repairGhHelpers } from "../lib/setup/install.mjs";
+import { bridgeCommands, bridgeIfNeeded } from "../lib/setup/bridge.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
 import { commentMarkdown } from "../lib/review/markdown.mjs";
 import { formatInvite, parseInvite } from "../lib/share/manifest.mjs";
@@ -87,9 +99,12 @@ switch (command) {
     await setup();
     break;
   case "install-service":
-    // Service installation only — no doctor/fix, no migrate. Used by
-    // scripts/setup-prod.sh so npm and source installs share one
-    // definition; WORK_SERVICE_EXEC points it at a checkout's run-prod.sh.
+    // Service installation only — no doctor/fix. Used by
+    // scripts/work-source.sh so a checkout and the npm package share one
+    // definition; WORK_SERVICE_EXEC points it at the checkout's
+    // run-local.sh. The database is brought to the baseline first all the
+    // same: a server this checkout builds cannot open one from before it.
+    await bridge();
     if (!installService()) {
       process.exitCode = 1;
     } else if (await waitForServer()) {
@@ -101,12 +116,6 @@ switch (command) {
       process.exitCode = 1;
     }
     break;
-  case "migrate":
-    // The one-shot cleanups alone, against the service's settings (and the
-    // checkout's .env.local when WORK_SERVICE_EXEC names one). Used by
-    // scripts/update.sh ahead of setup-prod.sh.
-    process.exitCode = migrate();
-    break;
   case "doctor":
     await doctorCmd();
     break;
@@ -151,7 +160,7 @@ switch (command) {
     break;
   default:
     console.log(
-      `work ${pkg.version}\n\nusage: work <setup|install-service|migrate|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
+      `work ${pkg.version}\n\nusage: work <setup|install-service|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
     );
 }
 
@@ -639,19 +648,24 @@ function until(iso) {
 }
 
 async function setup() {
-  await fix(await doctor());
-
-  migrate();
+  await bridge();
+  const d = await doctor(doctorOpts());
+  await fix(d);
+  // Before the service is written: a tailnet name to answer goes into the
+  // WORK_ALLOWED_HOSTS it carries.
+  const tailnet = await tailscale(d.tailscale);
 
   const running = installService();
   const port = serviceEnv().PORT;
-  maybeTunnel(port);
+  if (!tailnet) maybeTunnel(port);
   if (running) {
     if (await waitForServer()) log(`done — http://localhost:${port}`);
     else
       warn(
         `service started but nothing answered on port ${port} within 30s — check the logs`,
       );
+    if (tailnet)
+      log(`on your phone and other devices on the tailnet: ${tailnet}`);
   } else {
     // A fresh install's shell may not have mise on PATH yet — name the shim.
     const shim = path.join(
@@ -669,19 +683,24 @@ async function setup() {
   }
 }
 
-/** One-shot cleanups between versions (scripts/migrate.mjs), run against
- * the settings the service actually uses: migrate.mjs exits quietly when it
- * finds no db, so an ambient environment missing WORK_DATA_DIR skips every
- * sweep. A checkout's .env.local sits under both, as it does when its run
- * script starts the server. Returns the exit status. */
-function migrate() {
-  const script = path.join(pkgRoot, "scripts", "migrate.mjs");
-  if (!fs.existsSync(script)) return 0;
-  return (
-    spawnSync(process.execPath, [script], {
-      stdio: "inherit",
-      env: { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() },
-    }).status ?? 1
+/** Bring a database from before 0.1 to the baseline this release starts
+ * from (lib/setup/bridge.mjs), before anything touches the service: the
+ * server it would restart refuses such a database. Run with the settings
+ * the service uses (a checkout's .env.local under them, as its run script
+ * has it), so it finds the data dir the server opens rather than whatever
+ * this shell has. On failure the service is left as it was, and what to
+ * run by hand ends the output. */
+async function bridge() {
+  const env = { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() };
+  const dataDir =
+    env.WORK_DATA_DIR ||
+    path.join(
+      env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share"),
+      "work",
+    );
+  if (bridgeIfNeeded(dataDir, env, log)) return;
+  die(
+    `${path.join(dataDir, "work.db")} is still from before 0.1, so the service was left as it was. Run:\n  ${bridgeCommands(dataDir).join("\n  ")}`,
   );
 }
 
@@ -723,15 +742,19 @@ async function update() {
     "@dylanpiercey/work@latest",
   ]);
   // Re-exec the (possibly new) CLI to finish with fresh code.
-  sh("work", ["setup", ...(yes ? ["--yes"] : [])]);
+  sh("work", [
+    "setup",
+    ...(yes ? ["--yes"] : []),
+    ...args.filter((a) => a === "--tailscale" || a === "--no-tailscale"),
+  ]);
 }
 
 /** Machine readiness from lib/setup — the same probe the Settings page runs. */
 async function doctorCmd() {
-  let d = await doctor();
+  let d = await doctor(doctorOpts());
   if (args.includes("--fix")) {
     await fix(d);
-    d = await doctor();
+    d = await doctor(doctorOpts());
   }
   if (args.includes("--json")) {
     console.log(JSON.stringify(d, null, 2));
@@ -745,6 +768,13 @@ async function doctorCmd() {
   if (!d.ready) process.exitCode = 1;
 }
 
+/** What the doctor's Tailscale probe checks against: the port and allowed
+ * names the service runs with (or will, after `work setup`). */
+function doctorOpts() {
+  const env = serviceEnv();
+  return { port: env.PORT, allowedHosts: env.WORK_ALLOWED_HOSTS || "" };
+}
+
 /** Said when the service listens beyond this machine with nothing declared
  * to answer there: every other machine is refused (server/access.ts), which
  * is safe, but likely not what the listening was for. */
@@ -789,6 +819,13 @@ async function fix(d) {
         "GitHub is not signed in. Open the app and use Settings → GitHub → Sign in",
       );
   }
+  if (d.staleGhHelpers.length) {
+    try {
+      repairGhHelpers(d.staleGhHelpers, { log });
+    } catch (err) {
+      warn(`could not repair git's gh credential helper: ${err.message}`);
+    }
+  }
   // Agent CLIs are installed from the app (Settings → Agents), where each
   // one is a click and the picker updates immediately — no prompt here.
   if (!d.agents.some((a) => a.installed)) {
@@ -833,25 +870,6 @@ function serviceFile() {
       );
 }
 
-/** Whether an installed service with no WORK_LISTEN line was installed
- * before the this-machine-only default. On Linux its shape tells: under the
- * default, work.socket binds an address (`127.0.0.1:7171`), where an older
- * service had no socket or bound a bare port. A launchd agent has no such
- * tell. */
-function predatesListenDefault() {
-  if (!fs.existsSync(serviceFile())) return false;
-  if (process.platform === "darwin") return true;
-  try {
-    const socket = fs.readFileSync(
-      path.join(path.dirname(serviceFile()), "work.socket"),
-      "utf8",
-    );
-    return /^ListenStream=\d+\s*$/m.test(socket);
-  } catch {
-    return true;
-  }
-}
-
 /** One Environment= line systemd reads back as exactly this value. A value
  * holding whitespace, a quote, `\` or `%` is quoted, with `\` and `"`
  * escaped and `%` doubled, since systemd expands specifiers there: bare, a
@@ -901,8 +919,8 @@ function installedServiceEnv() {
     }
     return installed;
   }
-  // unitEnvLine's quoted form, or an older service's bare `KEY=value`,
-  // which was never escaped either.
+  // unitEnvLine's quoted form, or the bare `KEY=value` it writes for a
+  // plain value, which is not escaped either.
   const re =
     /^Environment=(?:"([A-Za-z_][A-Za-z0-9_]*)=((?:[^"\\]|\\.)*)"|([A-Za-z_][A-Za-z0-9_]*)=(.*))$/gm;
   for (const [, qKey, qValue, key, value] of text.matchAll(re)) {
@@ -916,9 +934,9 @@ function installedServiceEnv() {
 }
 
 /** WORK_* from the .env.local of the checkout WORK_SERVICE_EXEC runs, read
- * as scripts/env-local.sh reads it: that script exports them at start, under
- * whatever the service sets. Never written into the service, which would
- * shadow later edits of the file. */
+ * as scripts/run-local.sh reads it: that script exports them at start,
+ * under whatever the service sets. Never written into the service, which
+ * would shadow later edits of the file. */
 function checkoutEnvLocal() {
   const exec = process.env.WORK_SERVICE_EXEC;
   const out = {};
@@ -972,18 +990,8 @@ function serviceEnv() {
     const value = key in process.env ? process.env[key] : installed[key];
     if (value) env[key] = value;
   }
-  // A new install listens on this machine only, and its service says so, so
-  // that a missing line only ever means a service from before that default.
-  // Those listened on every interface, and other machines (a phone, the
-  // proxy in front of it) may be reaching it that way: keep it listening,
-  // so they get work's page naming the setting to add (server/access.ts)
-  // rather than a connection that is simply refused.
-  if (!env.WORK_LISTEN) {
-    env.WORK_LISTEN =
-      !("WORK_LISTEN" in process.env) && predatesListenDefault()
-        ? "0.0.0.0"
-        : "127.0.0.1";
-  }
+  // This machine only unless set, and the service says so.
+  env.WORK_LISTEN ||= "127.0.0.1";
   // entry.ts prefers PORT, so carrying WORK_APP_PORT forward without this
   // would leave the service on the default port anyway. A checkout's run
   // script serves the port its .env.local names, so the socket binds that
@@ -1022,9 +1030,7 @@ function isWorkServerCmd(cmd) {
   if (/\bwork(\.mjs)?\s+(setup|update|version)\b/.test(cmd)) return false;
   if (
     /\bwork\.mjs\s+start(?:\s|$)/.test(cmd) ||
-    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd) ||
-    /--why=work server is running/.test(cmd) ||
-    /--why="work server is running"/.test(cmd)
+    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd)
   )
     return true;
   // A built server or run script, by the absolute path an interpreter was
@@ -1035,9 +1041,7 @@ function isWorkServerCmd(cmd) {
   const argv = cmd.split(/\s+/);
   return argv.some((arg, i) => {
     if (
-      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-(?:prod|local)\.sh)$/.test(
-        arg,
-      )
+      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-local\.sh)$/.test(arg)
     )
       return false;
     const runner = argv
@@ -1129,10 +1133,9 @@ function killPids(pids, signal) {
   }
 }
 
-/** Stop the managed service *and* any leftover checkout / `work start`
- * process still bound to the port. A pre-npm install often wasn't the
- * current unit (or was a bare node), so restarting work.service left it
- * sitting in front of the new one. */
+/** Stop the managed service *and* any other work server still bound to
+ * the port — a `work start` left in a terminal, a checkout's — which would
+ * otherwise sit in front of the new one. */
 function stopOldCopies(port) {
   log("stopping any previous work server");
   if (process.platform === "darwin") {
@@ -1140,28 +1143,6 @@ function stopOldCopies(port) {
     spawnSync("launchctl", ["bootout", `gui/${uid}/dev.work.app`], {
       stdio: "ignore",
     });
-    const agents = path.join(os.homedir(), "Library/LaunchAgents");
-    try {
-      for (const name of fs.readdirSync(agents)) {
-        if (!name.endsWith(".plist")) continue;
-        const file = path.join(agents, name);
-        const text = fs.readFileSync(file, "utf8");
-        if (
-          !/dev\.work\.app|work\.mjs|run-prod\.sh|run-local\.sh|@dylanpiercey\/work/.test(
-            text,
-          )
-        )
-          continue;
-        const label = text.match(
-          /<key>Label<\/key>\s*<string>([^<]+)<\/string>/,
-        )?.[1];
-        if (label) {
-          spawnSync("launchctl", ["bootout", `gui/${uid}/${label}`], {
-            stdio: "ignore",
-          });
-        }
-      }
-    } catch {}
   } else if (have("systemctl")) {
     spawnSync("systemctl", ["--user", "stop", "work.service"], {
       stdio: "ignore",
@@ -1201,8 +1182,8 @@ function installService() {
   const port = serviceEnv().PORT;
   stopOldCopies(port);
   const cliPath = fileURLToPath(import.meta.url);
-  // One service definition serves both installers. A source install
-  // (scripts/setup-prod.sh) points the unit at this checkout's run-prod.sh
+  // One service definition serves the npm package and a checkout:
+  // scripts/work-source.sh points the unit at the checkout's run-local.sh
   // instead of the CLI — that script carries its own sleep inhibitor and
   // PORT handling, so no awake prefix is layered on top.
   const execOverride = process.env.WORK_SERVICE_EXEC;
@@ -1250,15 +1231,8 @@ ${envXml}
         stdio: "ignore",
       }).status === 0;
     if (!started) {
-      // A launchd that only speaks the legacy verbs: `load -w` honours
-      // RunAtLoad the same way.
-      started =
-        spawnSync("launchctl", ["load", "-w", plist], { stdio: "ignore" })
-          .status === 0;
-    }
-    if (!started) {
-      // Both refused because the job is loaded already (a bootout that did
-      // not take). Nothing spawned it with the new definition, and it is old
+      // Refused because the job is loaded already (a bootout that did not
+      // take). Nothing spawned it with the new definition, and it is old
       // enough not to be throttled, so restart it.
       started =
         spawnSync("launchctl", ["kickstart", "-k", label], { stdio: "ignore" })
@@ -1366,8 +1340,179 @@ function maybeTunnel(port = appPort) {
   if (yes || have("cloudflared")) return;
   console.log(`
 To reach work from your phone or other devices, put it behind something
-that terminates TLS and authenticates, e.g. a Cloudflare Tunnel with
+that terminates TLS and authenticates, e.g. Tailscale (\`work setup
+--tailscale\` runs \`tailscale serve\` for you) or a Cloudflare Tunnel with
 Access (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
-pointing at http://localhost:${port}, or Tailscale. The server itself has
-no auth of its own.`);
+pointing at http://localhost:${port}. The server itself has no auth of its
+own.`);
+}
+
+/**
+ * `tailscale serve` in front of work: https://<machine>.<tailnet>.ts.net/,
+ * TLS and the tailnet's own sign-in in the local daemon, proxied to work's
+ * port, so requests arrive from this machine under that name — which goes
+ * into WORK_ALLOWED_HOSTS. Tailnet only, never Funnel: Funnel publishes to
+ * the internet, and work has no login of its own. Tailscale's config is
+ * changed only on an explicit yes, the prompt's or `--tailscale`; `--yes`
+ * is how the installer, `work update` and the app's own update run setup
+ * unattended, and none of them asked for it. A serve config already
+ * pointing at work only has its name allowed. Returns the URL work is
+ * served at, or null.
+ */
+async function tailscale(ts) {
+  if (args.includes("--no-tailscale")) return null;
+  const asked = args.includes("--tailscale");
+  const port = serviceEnv().PORT;
+  if (!ts?.installed) {
+    if (asked)
+      warn(
+        "Tailscale is not installed: https://tailscale.com/download, then work setup --tailscale",
+      );
+    return null;
+  }
+  if (ts.serve) {
+    if (!allowTailnet(ts.serve)) return null;
+    if (ts.running) return servedAt(ts.serve.url);
+    // A serve config outlives a logout, and serves again once it is up.
+    log(
+      `Tailscale is ${stateText(ts)}: work is at ${ts.serve.url} once it is up`,
+    );
+    return null;
+  }
+  if (!ts.running) {
+    if (asked)
+      warn(
+        `Tailscale is ${stateText(ts)}: ${ts.state === null ? "start tailscaled" : "run `tailscale up`"}, then work setup --tailscale`,
+      );
+    return null;
+  }
+  const input = yes ? null : terminal();
+  try {
+    const refusal = serveRefusal(ts, port);
+    if (refusal) {
+      if (asked || input) warn(refusal);
+      return null;
+    }
+    const target = serveTarget(port);
+    const command = `tailscale serve --bg ${target}`;
+    if (!asked) {
+      if (!input) {
+        log(
+          `Tailscale is logged in: \`work setup --tailscale\` serves work at https://${ts.name}/ on your tailnet`,
+        );
+        return null;
+      }
+      console.log(`
+Tailscale is logged in here as ${ts.name}.
+\`${command}\` puts work at https://${ts.name}/
+for your devices on the tailnet (only them: never Funnel), proxied by the
+local Tailscale daemon to port ${port}.${ts.https === false ? "\nHTTPS certificates are off on your tailnet: tailscale prints a link that\nturns them on." : ""}`);
+      if (!(await confirm(input, `Run \`${command}\`? [y/N] `))) {
+        log(
+          "left Tailscale as it was (work setup --tailscale serves work later; --no-tailscale skips this question)",
+        );
+        return null;
+      }
+    } else if (ts.https === false && !input) {
+      // tailscale serve would wait, unattended, for someone to follow the
+      // link it prints.
+      warn(
+        "HTTPS certificates are off on your tailnet: turn them on (https://login.tailscale.com/admin/dns), then run work setup --tailscale",
+      );
+      return null;
+    }
+    log(command);
+    spawnSync(which("tailscale"), ["serve", "--bg", target], {
+      stdio: "inherit",
+    });
+  } finally {
+    if (input && input !== process.stdin) input.destroy();
+  }
+  // Its exit status is no proof: it exits 0 having only printed how to
+  // turn HTTPS on, when it does not wait for that.
+  const after = await tailscaleProbe({ port, allowedHosts: "" });
+  if (!after.serve) {
+    warn(
+      "tailscale serve did not serve work (see above); once it does, run work setup again",
+    );
+    return null;
+  }
+  return allowTailnet(after.serve) ? servedAt(after.serve.url) : null;
+}
+
+function servedAt(url) {
+  log(`Tailscale serves work at ${url} (tailnet only)`);
+  return url;
+}
+
+/** Why `tailscale serve --bg <port>` is not run here, or null. */
+function serveRefusal(ts, port) {
+  if (!ts.serveCli)
+    return `tailscale ${ts.version || "(unknown version)"} predates \`tailscale serve --bg <port>\` (1.52): update Tailscale, then run work setup --tailscale`;
+  // It would replace whatever serves the name's root now.
+  if (ts.rootTaken)
+    return `https://${ts.name}/ already serves ${ts.rootTaken}, which work leaves alone. To serve work beside it: tailscale serve --bg --https=8443 ${port}, then work setup`;
+  if (!serveTarget(port))
+    return `work listens on ${serviceEnv().WORK_LISTEN} alone, and tailscale serve proxies to loopback: WORK_LISTEN= work setup --tailscale`;
+  return null;
+}
+
+/** What `tailscale serve` proxies to: work's port on loopback, where
+ * requests are this machine's (server/access.ts). Null when work listens
+ * on one other address only, which loopback does not reach. */
+function serveTarget(port) {
+  const listen = serviceEnv().WORK_LISTEN;
+  if (listen === "::1") return `http://[::1]:${port}`;
+  return ["127.0.0.1", "0.0.0.0", "::", "*"].includes(listen)
+    ? String(port)
+    : null;
+}
+
+/** Put the name tailscale serve serves work under in WORK_ALLOWED_HOSTS,
+ * for installService() to write — or, when Funnel publishes that name to
+ * the internet, take it out, so work refuses the internet there. False
+ * then. */
+function allowTailnet(serve) {
+  const current = serviceEnv().WORK_ALLOWED_HOSTS || "";
+  const next = allowHost(current, serve.host, !serve.funnel);
+  if (next !== current) {
+    process.env.WORK_ALLOWED_HOSTS = next;
+    log(
+      `${serve.funnel ? "refusing" : "allowing"} ${serve.host} (WORK_ALLOWED_HOSTS=${next})`,
+    );
+  }
+  if (serve.funnel) {
+    warn(
+      `Tailscale Funnel publishes ${serve.url} to the internet, and work has no login, so work refuses that name. Turn Funnel off (tailscale funnel --https=${new URL(serve.url).port || 443} off), then run work setup again`,
+    );
+    return false;
+  }
+  return true;
+}
+
+/** Where to ask the user something: stdin when it is a terminal, else the
+ * controlling terminal, since the curl installer pipes its script into the
+ * shell this runs under. Null with no terminal at all. */
+function terminal() {
+  if (process.stdin.isTTY) return process.stdin;
+  try {
+    return new tty.ReadStream(fs.openSync("/dev/tty", "r"));
+  } catch {
+    return null;
+  }
+}
+
+/** A yes/no question, no unless answered yes. Line-buffered by the
+ * terminal itself, so Ctrl-C stops setup as it would anywhere else. */
+async function confirm(input, question) {
+  const rl = readline.createInterface({
+    input,
+    output: process.stdout,
+    terminal: false,
+  });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
 }