@dylanpiercey/work 0.1.0 → 0.2.0

package/dist/{_Bq7to522.js → _CzOrFOdN.js}

@@ -182,7 +182,7 @@ try {
 * open terminal. */
 var TMUX_SOCKET = process.env.WORK_TMUX_SOCKET || "work";
 var execFileAsync = promisify(execFile);
-async function run$1(cmd, args, cwd, env, opts = {}) {
+async function run$2(cmd, args, cwd, env, opts = {}) {
 	const child = execFileAsync(cmd, args, {
 		cwd,
 		env,
@@ -230,7 +230,7 @@ var git = async (args, cwd) => {
 	const verb = args.find((a) => !a.startsWith("-")) ?? "";
 	const timeoutMs = GIT_NETWORK_MS[verb];
 	try {
-		return await run$1("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
+		return await run$2("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
 	} catch (err) {
 		if (timeoutMs && err.killed) throw new Error(`git ${verb} timed out after ${Math.round(timeoutMs / 1e3)}s`);
 		throw err;
@@ -248,7 +248,7 @@ var gh = async (args, host) => {
 	const verb = args[0] ?? "";
 	const timeoutMs = GH_MS[verb] ?? GH_DEFAULT_MS;
 	try {
-		return await run$1("gh", args, void 0, host ? {
+		return await run$2("gh", args, void 0, host ? {
 			...process.env,
 			GH_HOST: host
 		} : void 0, { timeoutMs });
@@ -257,7 +257,7 @@ var gh = async (args, host) => {
 		throw err;
 	}
 };
-var tmux = (args, env, opts) => run$1("tmux", [
+var tmux = (args, env, opts) => run$2("tmux", [
 	"-L",
 	TMUX_SOCKET,
 	...args
@@ -347,11 +347,12 @@ function bridgeForServer(dataDir) {
 }
 //#endregion
 //#region src/server/migrations.ts
-var STEPS = [{
-	version: 1,
-	name: "baseline",
-	up(db) {
-		db.exec(`
+var STEPS = [
+	{
+		version: 1,
+		name: "baseline",
+		up(db) {
+			db.exec(`
         CREATE TABLE workspaces (
           id TEXT PRIMARY KEY,
           name TEXT NOT NULL,
@@ -421,49 +422,58 @@ var STEPS = [{
           PRIMARY KEY (workspace_id, worktree, branch, path)
         );
       `);
-	}
-}, {
-	version: 2,
-	name: "drop what 0.0.x kept for its upgrades",
-	up(db) {
-		db.exec(`
+		}
+	},
+	{
+		version: 2,
+		name: "drop what 0.0.x kept for its upgrades",
+		up(db) {
+			db.exec(`
         DELETE FROM review_marks WHERE path = '';
         DELETE FROM settings
           WHERE key IN ('review-cleared-diff-v2', 'ui.diff-uncommitted', 'diff-uncommitted')
              OR key GLOB 'review.seen:*';
       `);
-		for (const name of [
-			"tab",
-			"diff-filter",
-			"diff-folded",
-			"diff-collapsed",
-			"diff-focus",
-			"diff-pos",
-			"files-recent"
-		]) {
-			const prefix = `ui.${name}:`;
-			db.prepare("DELETE FROM settings WHERE key GLOB ? AND substr(key, ?) NOT IN (SELECT id FROM workspaces)").run(`${prefix}*`, prefix.length + 1);
+			for (const name of [
+				"tab",
+				"diff-filter",
+				"diff-folded",
+				"diff-collapsed",
+				"diff-focus",
+				"diff-pos",
+				"files-recent"
+			]) {
+				const prefix = `ui.${name}:`;
+				db.prepare("DELETE FROM settings WHERE key GLOB ? AND substr(key, ?) NOT IN (SELECT id FROM workspaces)").run(`${prefix}*`, prefix.length + 1);
+			}
+			const pref = (key) => db.prepare("SELECT value FROM settings WHERE key = ?").get(key)?.value;
+			const parse = (text) => {
+				try {
+					return text === void 0 ? void 0 : JSON.parse(text);
+				} catch {
+					return;
+				}
+			};
+			const font = parse(pref("ui.term-font"));
+			if (font && typeof font === "object") {
+				for (const device of ["desktop", "touch"]) if (Number.isInteger(font[device])) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)").run(`ui.term-font-${device}`, String(font[device]));
+			}
+			db.exec("DELETE FROM settings WHERE key = 'ui.term-font'");
+			const keys = parse(pref("ui.phone-keys"));
+			if (Array.isArray(keys)) db.prepare("UPDATE settings SET value = ? WHERE key = 'ui.phone-keys'").run(JSON.stringify({
+				base: [],
+				extra: keys
+			}));
 		}
-		const pref = (key) => db.prepare("SELECT value FROM settings WHERE key = ?").get(key)?.value;
-		const parse = (text) => {
-			try {
-				return text === void 0 ? void 0 : JSON.parse(text);
-			} catch {
-				return;
-			}
-		};
-		const font = parse(pref("ui.term-font"));
-		if (font && typeof font === "object") {
-			for (const device of ["desktop", "touch"]) if (Number.isInteger(font[device])) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)").run(`ui.term-font-${device}`, String(font[device]));
+	},
+	{
+		version: 3,
+		name: "drop the typing-prediction pref",
+		up(db) {
+			db.exec("DELETE FROM settings WHERE key = 'ui.term-predict'");
 		}
-		db.exec("DELETE FROM settings WHERE key = 'ui.term-font'");
-		const keys = parse(pref("ui.phone-keys"));
-		if (Array.isArray(keys)) db.prepare("UPDATE settings SET value = ? WHERE key = 'ui.phone-keys'").run(JSON.stringify({
-			base: [],
-			extra: keys
-		}));
 	}
-}];
+];
 var LATEST = STEPS.at(-1).version;
 /** The database at `file`, at the latest version: an empty one is built by
 * every step, an existing one gets those it lacks — each in a transaction
@@ -979,6 +989,418 @@ function agentLabel$1(id) {
 	const parsed = parseAgentId(id);
 	return parsed ? `${parsed.family.label}${parsed.suffix ? ` ${parsed.suffix}` : ""}` : id;
 }
+/** `tailscale version` prints the short version first (`1.76.1`, or
+* `1.77.30` on an unstable track), then commit lines. */
+function parseVersion(text) {
+	return /\b(\d+)\.(\d+)\.(\d+)\b/.exec(text || "")?.[0] ?? null;
+}
+function atLeast(version, min) {
+	const a = version.split(".").map(Number);
+	const b = min.split(".").map(Number);
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+	return true;
+}
+/** The target the CLI writes (`http://127.0.0.1:7171`) or one a hand-made
+* or older config holds (`localhost:7171`, `http://[::1]:7171`, `7171`),
+* when it is work's port on this machine. */
+function targetsPort(proxy, port) {
+	if (/^\d+$/.test(proxy)) return proxy === String(port);
+	let url;
+	try {
+		url = new URL(proxy.includes("://") ? proxy : `http://${proxy}`);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" && [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	].includes(url.hostname) && url.port === String(port);
+}
+/** The URL a `Web` entry (`<name>:<port>`) is opened at: https unless its
+* port is served as plain HTTP (`--http=<port>`). */
+function webUrl(config, hostPort) {
+	const i = hostPort.lastIndexOf(":");
+	const host = hostPort.slice(0, i);
+	const port = hostPort.slice(i + 1);
+	const tls = !config.TCP?.[port]?.HTTP;
+	return `${tls ? "https" : "http"}://${host}${port === (tls ? "443" : "80") ? "" : `:${port}`}/`;
+}
+/** Where `tailscale serve status --json` (an ipn.ServeConfig; `{}` or
+* `null` when empty) serves work's port, and whether Funnel publishes that
+* to the internet — or null. Only a handler at `/` counts: work serves
+* every page, asset and websocket from the root. */
+function serveOf(config, port) {
+	for (const [hostPort, web] of Object.entries(config?.Web || {})) {
+		const proxy = web?.Handlers?.["/"]?.Proxy;
+		if (!proxy || !targetsPort(proxy, port)) continue;
+		const url = webUrl(config, hostPort);
+		return {
+			url,
+			host: new URL(url).hostname,
+			funnel: !!config.AllowFunnel?.[hostPort]
+		};
+	}
+	return null;
+}
+function hosts(value) {
+	return (value || "").split(",").map((s) => s.trim()).filter(Boolean);
+}
+/**
+* The probe `work doctor` and `work setup` read, from the CLI's output:
+* `version` (`tailscale version`), `status` (`tailscale status --json`,
+* null when tailscaled did not answer) and `serve` (`tailscale serve
+* status --json`). `allowedHosts` is the WORK_ALLOWED_HOSTS the service
+* runs with.
+*/
+function readTailscale({ path, version: versionText, status, serve }, { port, allowedHosts }) {
+	const version = parseVersion(versionText);
+	const name = String(status?.Self?.DNSName || "").replace(/\.$/, "").toLowerCase() || null;
+	const certs = status?.CertDomains;
+	const https = Array.isArray(certs) ? certs.some((d) => d.toLowerCase() === name) : status && "CertDomains" in status ? false : null;
+	const served = serveOf(serve, port);
+	const root = name ? serve?.Web?.[`${name}:443`]?.Handlers?.["/"] : null;
+	return {
+		installed: true,
+		path,
+		version,
+		serveCli: !!version && atLeast(version, "1.52.0"),
+		state: status?.BackendState ?? null,
+		running: status?.BackendState === "Running" && !!name,
+		name,
+		https,
+		port: String(port),
+		serve: served && {
+			...served,
+			allowed: hosts(allowedHosts).some((h) => h.toLowerCase() === served.host)
+		},
+		rootTaken: !served && root ? root.Proxy || root.Path || root.Redirect || "text" : null
+	};
+}
+//#endregion
+//#region lib/setup/firewall.mjs
+/** The name work's own rule goes by: a firewalld service, a ufw comment. */
+var RULE = "work";
+var SOCKETFILTERFW = "usr/libexec/ApplicationFirewall/socketfilterfw";
+var CODESIGN = "usr/bin/codesign";
+/**
+* The active host firewall and whether it admits UDP `rtcPort`, or null
+* when none is active (or direct connections are off, `rtc` = "off").
+* `appPort` joins the rule when `listen` is beyond this machine, since the
+* app's own TCP port then has to be reachable too. `node` is the program
+* macOS's firewall is asked about (this process's by default: the server
+* asking for itself). `root` is where /etc and /usr are read from, and
+* `platform` the system taken for this one (a test's stand-ins).
+*/
+async function firewallProbe({ rtcPort, appPort, listen = "127.0.0.1", rtc, node = process.execPath, root = "/", platform = process.platform } = {}) {
+	if (rtc === "off") return null;
+	const port = Number(rtcPort) || Number(appPort) || 7171;
+	const tcp = loopback(listen) ? null : Number(appPort) || port;
+	const at = (p) => path.join(root, p);
+	if (platform === "darwin") return macos(port, node, at);
+	return await firewalld(port, tcp, at) ?? ufw(port, tcp, at);
+}
+async function firewalld(port, tcp, at) {
+	const bin = findBin("firewall-cmd");
+	if (!bin) return null;
+	const active = await run$1(bin, ["--get-active-zones"]);
+	if (!active.ok || !active.stdout.trim()) return null;
+	const zones = active.stdout.split("\n").filter((line) => line && !/^\s/.test(line)).map((line) => line.trim().split(/\s+/)[0]);
+	const byDefault = /^(\S+)\s+\(default\)/m.exec(active.stdout)?.[1];
+	const zone = byDefault && zones.includes(byDefault) ? byDefault : zones[0];
+	const services = await run$1(bin, ["--get-services"]);
+	const ruled = services.ok && services.stdout.split(/\s+/).includes("work");
+	const changed = readXml(at(`etc/firewalld/zones/${zone}.xml`));
+	const def = changed ?? readXml(at(`usr/lib/firewalld/zones/${zone}.xml`));
+	const exact = changed !== null;
+	const admits = ruled || def !== null && zoneAdmits(def, port, at);
+	const likely = !admits;
+	const plan = [
+		...ruled ? [] : [sudo("firewall-cmd", "--permanent", `--new-service=${RULE}`), sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--set-short=${RULE}`)],
+		sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--add-port=${port}/udp`),
+		...tcp ? [sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--add-port=${tcp}/tcp`)] : [],
+		sudo("firewall-cmd", "--permanent", `--zone=${zone}`, `--add-service=${RULE}`),
+		sudo("firewall-cmd", "--reload")
+	];
+	return result({
+		kind: "firewalld",
+		what: `firewalld (zone ${zone})`,
+		zone,
+		port,
+		admits,
+		likely,
+		exact,
+		ruled,
+		why: admits || exact ? null : "by the zone's definition as shipped",
+		plan: admits ? [] : plan
+	});
+}
+function ufw(port, tcp, at) {
+	let conf = "";
+	try {
+		conf = fs.readFileSync(at("etc/ufw/ufw.conf"), "utf8");
+	} catch {
+		return null;
+	}
+	if (!/^\s*ENABLED\s*=\s*yes/m.test(conf)) return null;
+	let policy = "DROP";
+	try {
+		policy = /^\s*DEFAULT_INPUT_POLICY\s*=\s*"?(\w+)/m.exec(fs.readFileSync(at("etc/default/ufw"), "utf8"))?.[1] ?? policy;
+	} catch {}
+	let rules = null;
+	try {
+		rules = fs.readFileSync(at("etc/ufw/user.rules"), "utf8");
+	} catch {}
+	const ruled = !!rules && new RegExp(`### tuple ### allow udp ${port} \\S+ \\S+ \\S+ in\\b`).test(rules);
+	const admits = policy === "ACCEPT" || ruled;
+	const plan = [sudo("ufw", "allow", `${port}/udp`, "comment", RULE), ...tcp ? [sudo("ufw", "allow", `${tcp}/tcp`, "comment", RULE)] : []];
+	return result({
+		kind: "ufw",
+		what: "ufw",
+		port,
+		admits,
+		likely: !admits,
+		exact: rules !== null,
+		ruled,
+		why: admits || rules !== null ? null : `by its default input policy, ${policy}`,
+		plan: admits ? [] : plan
+	});
+}
+/** macOS's application firewall filters by program, not port: what counts
+* is whether the node the server runs (`node`) may take connections. All
+* of it reads without root — the switch, "Block all incoming
+* connections", whether signed software is let in by itself, node's own
+* entry, and node's signature — and each parser takes what it can
+* recognise and leaves the rest unknown (`macosVerdict`), since the
+* wording has changed across releases. */
+async function macos(port, node, at) {
+	const bin = at(SOCKETFILTERFW);
+	if (!fs.existsSync(bin)) return null;
+	const real = realpath(node);
+	const said = (r) => `${r.stdout}\n${r.stderr}`;
+	const [state, blockAll, signed, blocked, apps, sign] = await Promise.all([
+		["--getglobalstate"],
+		["--getblockall"],
+		["--getallowsigned"],
+		["--getappblocked", real],
+		["--listapps"]
+	].map((a) => run$1(bin, a).then(said)).concat(run$1(at(CODESIGN), ["-dv", real]).then(said)));
+	const v = macosVerdict({
+		state,
+		blockAll,
+		signed,
+		blocked,
+		apps,
+		sign,
+		paths: [.../* @__PURE__ */ new Set([node, real])]
+	});
+	if (!v) return null;
+	const sfw = (...a) => sudo(bin, ...a);
+	const plan = v.needs === "unblock" ? [sfw("--unblockapp", real)] : v.needs === "add" ? [sfw("--add", real), sfw("--unblockapp", real)] : [];
+	return result({
+		kind: "macos",
+		what: "the macOS firewall",
+		port,
+		admits: v.admits,
+		likely: !v.admits,
+		exact: v.exact,
+		ruled: false,
+		why: v.why,
+		node: real,
+		plan,
+		fix: v.needs === "blockall" ? BLOCK_ALL_FIX : void 0
+	});
+}
+var BLOCK_ALL_FIX = "turn off “Block all incoming connections” (System Settings → Network → Firewall → Options); no rule for one program opens anything while it is on";
+/**
+* The macOS firewall's verdict on node from what socketfilterfw and
+* codesign said (their stdout and stderr, as text): null when the firewall
+* is off or its state could not be read. `needs` names the fix: `blockall`
+* (a setting only the user should change), `unblock` (node is listed and
+* blocked), `add` (node is not listed).
+*/
+function macosVerdict({ state, blockAll, signed, blocked, apps, sign, paths }) {
+	if (globalOn(state) !== true) return null;
+	if (blockAllOn(blockAll) ?? /State\s*=\s*2\b/.test(state)) return {
+		admits: false,
+		exact: true,
+		why: "“Block all incoming connections” is on",
+		needs: "blockall"
+	};
+	const entry = listedAs(apps, paths) ?? appBlocked(blocked);
+	if (entry === "block") return {
+		admits: false,
+		exact: true,
+		why: "node is blocked in it",
+		needs: "unblock"
+	};
+	if (entry === "allow") return {
+		admits: true,
+		exact: true,
+		why: "node is allowed in it",
+		needs: null
+	};
+	const signature = signatureOf(sign);
+	const auto = allowSigned(signed);
+	if (signature === "developer-id" && auto.downloaded || signature === "apple" && auto.builtIn) return {
+		admits: true,
+		exact: false,
+		why: `node is not listed, but it is ${signature === "apple" ? "Apple" : "Developer ID"}-signed and signed ${signature === "apple" ? "built-in" : "downloaded"} software is let in`,
+		needs: null
+	};
+	return {
+		admits: false,
+		exact: false,
+		why: `node is not listed, and ${signature === "developer-id" || signature === "apple" ? "signed software is not let in by itself" : signature === "adhoc" ? "an ad-hoc-signed program is not let in by itself" : signature === "unsigned" ? "an unsigned program is not let in by itself" : signature ? "a program not Developer ID-signed is not let in by itself" : "its signature could not be read"}, so its connections are dropped or asked about on the Mac's screen`,
+		needs: "add"
+	};
+}
+/** `--getglobalstate`: "Firewall is enabled. (State = 1)", "Firewall is
+* disabled. (State = 0)"; 2 is on with everything blocked. */
+function globalOn(text = "") {
+	const n = /State\s*=\s*(\d)/i.exec(text);
+	if (n) return n[1] !== "0";
+	if (/\bdisabled\b|\boff\b/i.test(text)) return false;
+	if (/\benabled\b|\bon\b/i.test(text)) return true;
+	return null;
+}
+/** `--getblockall`: "Block all ENABLED!" / "Block all DISABLED!", or
+* "Firewall has block all state set to enabled." / "… disabled." */
+function blockAllOn(text = "") {
+	if (!/block\s*all/i.test(text)) return null;
+	if (/\bdisabled\b|\boff\b/i.test(text)) return false;
+	if (/\benabled\b|\bon\b/i.test(text)) return true;
+	return null;
+}
+/** `--getallowsigned`: "Automatically allow built-in signed software
+* ENABLED." and "Automatically allow downloaded signed software
+* ENABLED." (older: "… allow signed built-in software …", or one "… allow
+* signed software …" switch for both). */
+function allowSigned(text = "") {
+	const out = {
+		builtIn: null,
+		downloaded: null
+	};
+	for (const line of text.split("\n")) {
+		if (!/signed/i.test(line)) continue;
+		const on = /\bdisabled\b|\boff\b/i.test(line) ? false : /\benabled\b|\bon\b/i.test(line) ? true : null;
+		if (on === null) continue;
+		if (/download/i.test(line)) out.downloaded = on;
+		else if (/built-?\s?in/i.test(line)) out.builtIn = on;
+		else out.builtIn = out.downloaded = on;
+	}
+	return out;
+}
+/** `--listapps`: "ALF: total number of apps = 2", then per app "1 :
+* /path" and, on its next line or after the path, "( Allow incoming
+* connections )" or "( Block incoming connections )". */
+function listedAs(text = "", paths = []) {
+	const lines = text.split("\n");
+	for (let i = 0; i < lines.length; i++) {
+		const m = /^\s*\d+\s*:\s*(.+?)\s*(?:\(([^)]*)\))?\s*$/.exec(lines[i]);
+		if (!m || !paths.includes(m[1].trim())) continue;
+		for (const said of [m[2] ?? "", ...lines.slice(i + 1, i + 4)]) {
+			if (/^\s*\d+\s*:/.test(said)) break;
+			if (/\bblock/i.test(said)) return "block";
+			if (/\b(allow|permit)/i.test(said)) return "allow";
+		}
+	}
+	return null;
+}
+/** `--getappblocked <path>`: "… is permitted" / "… is blocked", or that it
+* is not part of the firewall (not listed). */
+function appBlocked(text = "") {
+	if (/not part of|isn['’]?t part|not (?:a )?(?:listed|found|in the)|no such|does not exist/i.test(text)) return null;
+	if (/\bpermitted\b|\ballowed\b|\bunblocked\b|\bnot blocked\b/i.test(text)) return "allow";
+	if (/\bblocked\b/i.test(text)) return "block";
+	return null;
+}
+/** `codesign -dv <path>` (on stderr): "Authority=Developer ID
+* Application: …", Apple's own ("Authority=Software Signing"),
+* "Signature=adhoc", or "code object is not signed at all". */
+function signatureOf(text = "") {
+	if (/not signed at all/i.test(text)) return "unsigned";
+	if (/^Authority=Developer ID Application\b/im.test(text)) return "developer-id";
+	if (/^Authority=(Software Signing|Apple Code Signing|Apple Mac OS Application Signing)\b/im.test(text)) return "apple";
+	if (/^Signature=adhoc\b|\badhoc\b/im.test(text)) return "adhoc";
+	if (/^Authority=/im.test(text)) return "other";
+	return null;
+}
+function result(r) {
+	return {
+		...r,
+		fix: r.fix ?? (r.plan.length ? r.plan.map(shell).join(" && ") : null)
+	};
+}
+/** Whether a firewalld zone definition lets UDP `port` in: by its target,
+* a port range of its own, or a service it names (a readable one). */
+function zoneAdmits(xml, port, at) {
+	if (/<zone[^>]*\btarget="ACCEPT"/.test(xml)) return true;
+	if (portsAdmit(xml, port)) return true;
+	for (const [, name] of xml.matchAll(/<service\s+name="([^"]+)"/g)) {
+		const svc = readXml(at(`etc/firewalld/services/${name}.xml`)) ?? readXml(at(`usr/lib/firewalld/services/${name}.xml`));
+		if (svc && portsAdmit(svc, port)) return true;
+	}
+	return false;
+}
+function portsAdmit(xml, port) {
+	for (const [tag] of xml.matchAll(/<port\b[^>]*>/g)) {
+		const proto = /protocol="(\w+)"/.exec(tag)?.[1];
+		const range = /port="(\d+)(?:-(\d+))?"/.exec(tag);
+		if (proto !== "udp" || !range) continue;
+		const lo = Number(range[1]);
+		const hi = Number(range[2] ?? range[1]);
+		if (port >= lo && port <= hi) return true;
+	}
+	return false;
+}
+function realpath(file) {
+	try {
+		return fs.realpathSync(file);
+	} catch {
+		return file;
+	}
+}
+function sudo(...args) {
+	return ["sudo", ...args];
+}
+function shell(argv) {
+	return argv.map((a) => /^[\w@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+}
+function loopback(listen) {
+	return !listen || listen === "::1" || /^127\./.test(listen) || listen === "localhost";
+}
+function readXml(file) {
+	try {
+		return fs.readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+}
+/** A program on PATH, or in the sbin directories a user's PATH can leave
+* out. */
+function findBin(name) {
+	const dirs = [
+		...(process.env.PATH || "").split(path.delimiter),
+		"/usr/sbin",
+		"/sbin"
+	];
+	for (const dir of dirs) {
+		if (!dir) continue;
+		const full = path.join(dir, name);
+		try {
+			if (fs.statSync(full).isFile()) return full;
+		} catch {}
+	}
+	return null;
+}
+function run$1(cmd, args) {
+	return new Promise((resolve) => execFile(cmd, args, { timeout: 5e3 }, (err, stdout, stderr) => resolve({
+		ok: !err,
+		stdout: String(stdout || ""),
+		stderr: String(stderr || "")
+	})));
+}
 //#endregion
 //#region lib/setup/doctor.mjs
 var home = os.homedir();
@@ -1282,11 +1704,51 @@ async function ghExtensions() {
 	}
 	return out;
 }
+function parseJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/** Tailscale here and what its serve config does with work's port
+* (lib/setup/tailscale.mjs), from read-only commands. `port` and
+* `allowedHosts` default to this process's own, which are the server's
+* when the server asks. */
+async function tailscaleProbe({ port, allowedHosts } = {}) {
+	const bin = which("tailscale");
+	if (!bin) return { installed: false };
+	const [version, status, serve] = await Promise.all([
+		run(bin, ["version"], { timeout: 5e3 }),
+		run(bin, [
+			"status",
+			"--json",
+			"--peers=false"
+		], { timeout: 5e3 }),
+		run(bin, [
+			"serve",
+			"status",
+			"--json"
+		], { timeout: 5e3 })
+	]);
+	return readTailscale({
+		path: tilde(bin),
+		version: version.stdout,
+		status: status.ok ? parseJson(status.stdout) : null,
+		serve: serve.ok ? parseJson(serve.stdout) : null
+	}, {
+		port: port || process.env.PORT || process.env.WORK_APP_PORT || "7171",
+		allowedHosts: allowedHosts ?? process.env.WORK_ALLOWED_HOSTS
+	});
+}
 /**
 * Full readiness snapshot.
 *
-* @param {{ hosts?: string[] }} [opts] configured GitHub hosts (settings);
-*   github.com and any host gh is already signed in to are always included.
+* @param {{ hosts?: string[], port?: string, allowedHosts?: string }} [opts]
+*   configured GitHub hosts (settings); github.com and any host gh is
+*   already signed in to are always included. `port` and `allowedHosts`
+*   are the service's, for the Tailscale probe; `firewall`, when given, is
+*   the service's own firewall reading (`serviceFirewall` in the CLI).
 */
 async function doctor(opts = {}) {
 	const hostSet = /* @__PURE__ */ new Set([
@@ -1294,12 +1756,19 @@ async function doctor(opts = {}) {
 		...opts.hosts || [],
 		...ghKnownHosts()
 	]);
-	const [versions, github, awake, extensions, helpers] = await Promise.all([
+	const [versions, github, awake, extensions, helpers, tailscale, firewall] = await Promise.all([
 		miseVersions(),
 		Promise.all([...hostSet].map(githubHostStatus)),
 		canStayAwake(),
 		ghExtensions(),
-		staleGhHelpers()
+		staleGhHelpers(),
+		tailscaleProbe(opts),
+		opts.firewall !== void 0 ? opts.firewall : firewallProbe({
+			rtcPort: opts.rtcPort ?? process.env.WORK_RTC_PORT,
+			appPort: opts.port || process.env.PORT || process.env.WORK_APP_PORT || "7171",
+			listen: opts.listen ?? process.env.WORK_LISTEN,
+			rtc: opts.rtc ?? process.env.WORK_RTC
+		})
 	]);
 	const tools = TOOLS.map((t) => {
 		if (t.ghExtension) {
@@ -1341,7 +1810,9 @@ async function doctor(opts = {}) {
 		agents,
 		github,
 		awake,
-		staleGhHelpers: helpers
+		staleGhHelpers: helpers,
+		tailscale,
+		firewall
 	};
 }
 //#endregion
@@ -5862,7 +6333,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var crypto$3 = __require("crypto");
 	var asn1 = require_asn1();
 	var jws = require_jws();
-	var { URL } = __require("url");
+	var { URL: URL$1 } = __require("url");
 	var WebPushConstants = require_web_push_constants();
 	var urlBase64Helper = require_urlsafe_base64_helper();
 	/**
@@ -5913,7 +6384,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (typeof subject !== "string" || subject.length === 0) throw new Error("The subject value must be a string containing an https: URL or mailto: address. " + subject);
 		let subjectParseResult = null;
 		try {
-			subjectParseResult = new URL(subject);
+			subjectParseResult = new URL$1(subject);
 		} catch (err) {
 			throw new Error("Vapid subject is not a valid URL. " + subject);
 		}
@@ -5975,7 +6446,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (!audience) throw new Error("No audience could be generated for VAPID.");
 		if (typeof audience !== "string" || audience.length === 0) throw new Error("The audience value must be a string containing the origin of a push service. " + audience);
 		try {
-			new URL(audience);
+			new URL$1(audience);
 		} catch (err) {
 			throw new Error("VAPID audience is not a url. " + audience);
 		}
@@ -7606,7 +8077,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_CkwTsHKB.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_DiOv9AKj.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -8549,7 +9020,7 @@ async function token() {
 	const fromHosts = hostsToken();
 	if (fromHosts) return fromHosts;
 	try {
-		return await run$1("gh", ["auth", "token"]) || null;
+		return await run$2("gh", ["auth", "token"]) || null;
 	} catch {
 		return null;
 	}
@@ -9843,7 +10314,7 @@ async function listPanesNow() {
 * (tmux exits when its last session closes). */
 async function ensureTmuxServer() {
 	if (await tmux(["has-session"]).then(() => true, () => false)) return;
-	await run$1("systemd-run", [
+	await run$2("systemd-run", [
 		"--user",
 		`--unit=${TMUX_SOCKET === "work" ? "work-tmux" : `work-tmux-${TMUX_SOCKET.replace(/[^\w.:-]/g, "_")}`}`,
 		"--service-type=forking",
@@ -10115,4 +10586,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { saveSubscription as $, swr as $t, clearAgentPhase as A, TOOLS as At, agentBadge as B, readBody as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, which as Dt, realInside as E, tilde as Et, onPhaseChange as F, applyPrefChange as Ft, ACCENT_RE as G, TMUX_SOCKET as Gt, agentFromCommand as H, db as Ht, setAgentPhase as I, FRAME_ANCESTORS as It, manifest as J, gitEnv as Jt, getInstance as K, gh as Kt, setScrapedPhase as L, FRAME_HEADERS as Lt, hookReportedAt as M, agentLabel$1 as Mt, noteBackground as N, catalogPin as Nt, blankRow as O, DEFAULT_GITHUB_HOST as Ot, noteUserAnswered as P, toolById as Pt, pushPublicKey as Q, shared as Qt, setSessionViewers as R, checked as Rt, AGENTS as S, miseInstalls as St, inside as T, stableGh as Tt, agentLabel as U, get as Ut, agentFamily as V, all as Vt, agentMeta as W, workspacePath as Wt, setInstance as X, tmux as Xt, normalizeAccent as Y, run$1 as Yt, deleteSubscription as Z, config as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, withLock as en, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentById as jt, agentPhase as k, PROJECT_TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, git as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, httpError as zt };
+export { saveSubscription as $, shared as $t, clearAgentPhase as A, PROJECT_TOOLS as At, agentBadge as B, httpError as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, which as Dt, realInside as E, tilde as Et, onPhaseChange as F, toolById as Ft, ACCENT_RE as G, workspacePath as Gt, agentFromCommand as H, all as Ht, setAgentPhase as I, applyPrefChange as It, manifest as J, git as Jt, getInstance as K, TMUX_SOCKET as Kt, setScrapedPhase as L, FRAME_ANCESTORS as Lt, hookReportedAt as M, agentById as Mt, noteBackground as N, agentLabel$1 as Nt, blankRow as O, firewallProbe as Ot, noteUserAnswered as P, catalogPin as Pt, pushPublicKey as Q, config as Qt, setSessionViewers as R, FRAME_HEADERS as Rt, AGENTS as S, miseInstalls as St, inside as T, stableGh as Tt, agentLabel as U, db as Ut, agentFamily as V, readBody as Vt, agentMeta as W, get as Wt, setInstance as X, run$2 as Xt, normalizeAccent as Y, gitEnv as Yt, deleteSubscription as Z, tmux as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, swr as en, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, TOOLS as jt, agentPhase as k, DEFAULT_GITHUB_HOST as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, gh as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, withLock as tn, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, checked as zt };