@hienlh/ppm 0.18.12 → 0.18.13

package/src/services/db.service.ts

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import { mkdirSync, existsSync } from "node:fs";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
 import { getPpmDir } from "./ppm-dir.ts";
-export const CURRENT_SCHEMA_VERSION = 41;
+export const CURRENT_SCHEMA_VERSION = 42;
 
 let db: Database | null = null;
 let dbProfile: string | null = null;
@@ -899,6 +899,34 @@ function runMigrations(database: Database): void {
     try { database.exec("ALTER TABLE turn_usage ADD COLUMN account_label TEXT"); } catch { /* column exists */ }
     database.exec("PRAGMA user_version = 41;");
   }
+
+  if (current < 42) {
+    // Unread rows created before `incrementSessionUnread` learned the project name have
+    // `project_name IS NULL`. They could not heal on their own: the bell refuses to open a
+    // session it cannot place, so the connection that would have filled the name never
+    // happens, and the entry comes back on every reload. Fill them from the mapping that
+    // already knows, same shape as the v11 backfill above.
+    database.exec(`
+      UPDATE session_metadata SET
+        project_name = COALESCE(project_name, (
+          SELECT project_name FROM session_map
+          WHERE session_map.sdk_id = session_metadata.session_id
+             OR session_map.ppm_id = session_metadata.session_id
+        )),
+        project_path = COALESCE(project_path, (
+          SELECT project_path FROM session_map
+          WHERE session_map.sdk_id = session_metadata.session_id
+             OR session_map.ppm_id = session_metadata.session_id
+        ))
+      WHERE project_name IS NULL OR project_path IS NULL
+    `);
+    database.exec(`
+      UPDATE session_metadata SET project_path = (
+        SELECT path FROM projects WHERE projects.name = session_metadata.project_name
+      ) WHERE project_path IS NULL AND project_name IS NOT NULL
+    `);
+    database.exec("PRAGMA user_version = 42;");
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1161,17 +1189,26 @@ export interface UnreadEntry {
   sessionTitle: string | null;
 }
 
-/** Increment unread count for a session and set the notification type + title snapshot */
-export function incrementSessionUnread(sessionId: string, type: string, title?: string | null): void {
-  if (title) {
-    getDb().query(
-      "UPDATE session_metadata SET unread_count = unread_count + 1, unread_type = ?, last_known_title = ? WHERE session_id = ?",
-    ).run(type, title, sessionId);
-  } else {
-    getDb().query(
-      "UPDATE session_metadata SET unread_count = unread_count + 1, unread_type = ? WHERE session_id = ?",
-    ).run(type, sessionId);
-  }
+/** Increment unread count for a session and set the notification type + title snapshot.
+ *
+ *  Row-creating, like {@link setSessionUnread}. A session PPM did not create — resumed
+ *  here, or started in the CLI — has no `session_metadata` row, and an UPDATE against a
+ *  missing row silently dropped the unread entry altogether.
+ *
+ *  `project_name` is filled in the same statement so the bell can group and open the
+ *  session, and the COALESCE keeps the *stored* name: a name arriving later is not
+ *  evidence the session moved, and letting it win would let a stale name in a persisted
+ *  tab's URL overwrite a good one. */
+export function incrementSessionUnread(sessionId: string, type: string, title?: string | null, projectName?: string | null): void {
+  getDb().query(
+    `INSERT INTO session_metadata (session_id, unread_count, unread_type, last_known_title, project_name)
+     VALUES (?, 1, ?, ?, ?)
+     ON CONFLICT(session_id) DO UPDATE SET
+       unread_count = session_metadata.unread_count + 1,
+       unread_type = excluded.unread_type,
+       last_known_title = COALESCE(excluded.last_known_title, session_metadata.last_known_title),
+       project_name = COALESCE(session_metadata.project_name, excluded.project_name)`,
+  ).run(sessionId, type, title ?? null, projectName ?? null);
 }
 
 /** Manually mark a session unread (idempotent: SETS count to 1, not increment; row-creating).
@@ -1188,6 +1225,19 @@ export function setSessionUnread(sessionId: string, type: string, title?: string
   ).run(sessionId, type, title ?? null, projectName ?? null);
 }
 
+/** Mark several sessions as read in one transaction.
+ *  Clearing is project-agnostic — the read route never looked at the project segment —
+ *  so this works for rows whose project is unknown or names a project that no longer
+ *  exists, which is exactly the set that could not be cleared before. */
+export function clearSessionUnreadMany(sessionIds: string[]): void {
+  if (sessionIds.length === 0) return;
+  const db = getDb();
+  const stmt = db.query("UPDATE session_metadata SET unread_count = 0, unread_type = NULL WHERE session_id = ?");
+  db.transaction(() => {
+    for (const id of sessionIds) stmt.run(id);
+  })();
+}
+
 /** Mark a session as read (reset unread count) */
 export function clearSessionUnread(sessionId: string): void {
   getDb().query(

package/src/services/extension-rpc-handlers.ts

@@ -8,6 +8,7 @@ import type { RpcChannel } from "./extension-rpc.ts";
 import { contributionRegistry } from "./contribution-registry.ts";
 import { broadcastExtMsg, requestFromBrowser } from "../server/ws/extensions.ts";
 import { getProjects } from "./db.service.ts";
+import { isSecretConfigKey, redactSecretConfigValue } from "./config-secret-keys.ts";
 
 let requestIdCounter = 0;
 function nextRequestId(): string {
@@ -153,11 +154,18 @@ export function registerVscodeCompatHandlers(rpc: RpcChannel): void {
   // --- workspace config ---
   rpc.onRequest("workspace:config:get", async (params) => {
     const [key] = params as [string];
+    // An extension gets no signal beyond "not present" for a secret key —
+    // same not-found shape as a key that genuinely does not exist.
+    if (isSecretConfigKey(key)) return null;
     // Read from PPM config service
     try {
       const { configService } = await import("./config.service.ts");
       const config = configService.getAll() as unknown as Record<string, unknown>;
-      return getNestedValue(config, key) ?? null;
+      const value = getNestedValue(config, key) ?? null;
+      // A request for an ANCESTOR of a secret key (e.g. "tunnel", "auth")
+      // is not caught by isSecretConfigKey above and still holds the raw
+      // object here, so deep-redact before it crosses the RPC boundary.
+      return value === null ? null : redactSecretConfigValue(key, value);
     } catch {
       return null;
     }

package/src/services/file-watcher/watch-tree.ts

@@ -8,23 +8,50 @@ import { RecreatedDirPoller } from "./recreated-dir-poller.ts";
  * near the number of *interesting* ones.
  *
  * `fs.watch(root, { recursive: true })` is a single call, but on Linux the runtime
- * expands it into one inotify watch per subdirectory — dependency trees included.
- * Filtering those events on arrival (what this service used to do) still pays the
- * full cost, which is how a handful of projects reached ~360k watches and pushed
- * the machine against `fs.inotify.max_user_watches`.
+ * expands it into one inotify watch per *entry* — every file as well as every
+ * directory, dependency trees included. Filtering those events on arrival (what this
+ * service used to do) still pays the full cost, which is how a handful of projects
+ * reached ~360k watches and pushed the machine against `fs.inotify.max_user_watches`.
  *
- * So coverage is chosen up front: a subtree with no ignored directory anywhere
- * inside it gets one native recursive watch (cheap, and the runtime tracks new
- * directories for us); any subtree that contains an ignored directory gets a
- * non-recursive watch plus per-child recursion, so the ignored branch is never
- * handed to the runtime. That keeps the watcher count small — which also keeps
- * `fs.inotify.max_user_instances` out of play — while pruning ~92% of the
- * directories in a typical repo.
+ * So coverage is chosen up front, and the shape depends on what the platform's
+ * recursive watch actually is.
+ *
+ * On Windows and macOS it is a kernel-side subtree watch (`ReadDirectoryChangesW`,
+ * FSEvents): one handle covers a whole subtree, it tracks directories created later,
+ * and it does not traverse reparse points. Measured on Windows 11 / Bun 1.3.10 over a
+ * 2,441-directory tree, one recursive handle attaches in 80ms for +7.0MB where one
+ * handle per directory takes 965ms for +25.2MB. So a subtree with no ignored directory
+ * inside it gets a single recursive watch there.
+ *
+ * On Linux there is no such call. Bun emulates it by walking the tree and opening a
+ * watch per entry, and that cost does not depend on the shape: measured over 4
+ * directories holding 600 files, one recursive handle and one non-recursive handle per
+ * directory both come to 604 descriptors on a single inotify instance. So this split
+ * buys nothing in inotify terms — the handle count was never what `max_user_instances`
+ * counts — and it is not why Linux takes a handle per directory.
+ *
+ * What it buys is coverage. The emulation differs from this scan in two ways: it does
+ * not pick up directories created after it attached, and it walks through symlinks this
+ * scan deliberately skips — a pnpm workspace with a symlinked `node_modules` had its
+ * whole store watched, one open descriptor per file, which exhausted the process at
+ * ~724k descriptors.
+ *
+ * Either way the walk below is what prunes ~92% of the directories in a typical repo,
+ * and an ignored branch is never handed to the runtime.
  */
 
 /** Coalesce a burst of directory churn into a single subtree rebuild. */
 const REBUILD_DEBOUNCE_MS = 500;
 
+/**
+ * Whether `{ recursive: true }` is a real subtree watch rather than a per-directory walk.
+ * Named platforms rather than `!== "linux"`, so a runtime nobody has measured here —
+ * freebsd, say — takes the conservative walk instead of inheriting a promise about
+ * `ReadDirectoryChangesW`. `RecreatedDirPoller` is derived from this for the same reason:
+ * the emulation is a different mechanism with different defects.
+ */
+const NATIVE_RECURSIVE = process.platform === "win32" || process.platform === "darwin";
+
 export interface WatchTreeOptions {
   /** Absolute path of the directory to watch. */
   root: string;
@@ -81,7 +108,10 @@ export class WatchTree {
   constructor(private readonly options: WatchTreeOptions) {
     // Only Bun on Linux has the stale-watch defect; elsewhere re-watching works
     // and paying for polling would be pure waste.
-    this.poller = process.platform === "linux"
+    // Tied to NATIVE_RECURSIVE rather than re-testing the platform: the poller stands in
+    // for a defect of the same emulation, and `attach()` relies on exactly one of the two
+    // being in play. Deriving it here keeps that from drifting apart.
+    this.poller = !NATIVE_RECURSIVE
       ? new RecreatedDirPoller({ onChange: (abs) => this.reportAbs(abs) })
       : null;
   }
@@ -135,13 +165,23 @@ export class WatchTree {
     }
 
     for (const entry of entries) {
-      // isDirectory() is false for symlinks, which keeps link cycles and
-      // duplicate coverage (pnpm stores, workspace links) out of the walk.
-      if (!entry.isDirectory()) continue;
-      if (isIgnoredDirName(entry.name)) {
+      // A symlink named like an ignored directory still has to mark the subtree, or an
+      // ancestor takes a recursive watch over a `node_modules` this walk never entered —
+      // which is how a pnpm store got watched through the link. Tested before
+      // isDirectory(), which is false for symlinks. Plain files are deliberately left out:
+      // IGNORED_DIRS holds names like `build`, `out` and `target`, and a compiled binary
+      // called `build` is no reason to cost everything around it its recursive coverage.
+      // A symlink to a *file* is caught here too, since telling it from a link to a
+      // directory needs a stat() the walk would otherwise never make. It holds no subtree,
+      // so marking it only forfeits recursive coverage — the safe direction, and it takes
+      // a file named exactly `node_modules` or `target` to happen at all.
+      if (isIgnoredDirName(entry.name) && (entry.isDirectory() || entry.isSymbolicLink())) {
         node.hasIgnored = true;
         continue;
       }
+      // isDirectory() is false for symlinks, which keeps link cycles and
+      // duplicate coverage (pnpm stores, workspace links) out of the walk.
+      if (!entry.isDirectory()) continue;
       if (budget.left <= 0) {
         // Unscanned directories remain: mark the node so no ancestor covers them
         // recursively, since we cannot know what they hold.
@@ -161,23 +201,17 @@ export class WatchTree {
   private attach(node: ScanNode): void {
     const fitsWholeSubtree = this.covered + node.size <= this.options.maxDirs;
 
-    // A path we have watched before is being re-attached, so this directory was
-    // deleted and recreated. On Bun + Linux its watcher will never fire again:
-    // poll its own entries, and cover the subtree non-recursively so each child
-    // gets a watcher on a path the runtime still honours.
-    if (this.poller && this.everAttached.has(node.path)) {
-      this.poller.add(node.path);
-      if (this.covered + 1 > this.options.maxDirs) {
-        this.truncated = true;
-        return;
-      }
-      this.addWatcher(node.path, false, 1);
-      for (const child of node.dirs) this.attach(child);
-      return;
-    }
-
-    // One recursive watch for a subtree the runtime can safely expand on its own.
-    if (!node.hasIgnored && fitsWholeSubtree && this.addWatcher(node.path, true, node.size)) return;
+    // A path we have watched before is being re-attached, so this directory was deleted
+    // and recreated, and on Bun + Linux its watcher will never fire again — poll its own
+    // entries instead. It needs no special coverage beyond that: the poller only exists
+    // where the recursive branch below is off, so the per-directory walk it falls through
+    // to is already the watch-on-a-path-the-runtime-still-honours this case wants.
+    if (this.poller && this.everAttached.has(node.path)) this.poller.add(node.path);
+
+    // One recursive watch for a subtree the runtime can safely expand on its own —
+    // only where that is a kernel-side subtree watch rather than a per-directory walk.
+    if (NATIVE_RECURSIVE && !node.hasIgnored && fitsWholeSubtree
+        && this.addWatcher(node.path, true, node.size)) return;
 
     // Otherwise cover this directory alone and recurse — a failed recursive attach
     // falls through to here too, so one unwatchable directory cannot silently drop

package/src/services/file-watcher.service.ts

@@ -2,17 +2,32 @@ import { WatchTree } from "./file-watcher/watch-tree.ts";
 
 const DEBOUNCE_MS = 500;
 /**
- * Directory budgets. One covered directory costs one inotify watch on Linux, and
- * the machine-wide default ceiling is 524288 shared with every other process, so
- * PPM stays well inside it even with several projects watched at once.
+ * Directory budgets. These bound the directories PPM *covers*, which is not the same as
+ * the inotify watches it holds: measured on Linux, watching a directory costs one
+ * descriptor for it plus one for every file inside — 4 directories holding 600 files
+ * come to 604, recursive and non-recursive alike. So a directory cap bounds handles and
+ * walk cost, not descriptors; what keeps PPM inside the machine-wide 524288 ceiling is
+ * never registering `node_modules` in the first place.
  *
- * The per-project cap is hard. The total is best-effort: a native recursive watch
- * picks up directories created later without telling us, so exact accounting is not
- * possible — the worst case is a few projects at their own cap, still ~4% of the
- * kernel ceiling.
+ * The per-project cap is hard. The total is best-effort: a tree keeps growing after
+ * it starts, through `syncChildDir` -> `cover`, up to its own `maxDirs` — and on
+ * Windows/macOS a recursive handle covers directories created later without telling
+ * us either. So projects can add up past the total.
+ *
+ * A pnpm monorepo runs past 8000 directories on its own — the cap then silently stops
+ * watching the rest of the tree, which reads as a file change that never arrives.
+ * 12000 covers those with room to spare.
+ */
+const MAX_DIRS_PER_PROJECT = 12_000;
+const MAX_DIRS_TOTAL = 30_000;
+/**
+ * Floor on what a project is handed. Dividing the total down to nothing is worse than
+ * overshooting it: at 12000 per project the budgets ran 12000 -> 8000 -> **0**, and a
+ * project watching zero directories reports no changes at all — the same "file change
+ * that never arrives", total instead of partial, and indistinguishable from a broken
+ * watcher. A late project now gets a small budget and the truncation warning instead.
  */
-const MAX_DIRS_PER_PROJECT = 8_000;
-const MAX_DIRS_TOTAL = 20_000;
+const MIN_DIRS_PER_PROJECT = 1_000;
 
 type ChangeCallback = (projectName: string, path: string) => void;
 
@@ -64,7 +79,10 @@ export function startWatching(projectName: string, projectPath: string): void {
     return;
   }
 
-  const maxDirs = Math.max(0, Math.min(MAX_DIRS_PER_PROJECT, MAX_DIRS_TOTAL - totalCoveredDirs()));
+  const maxDirs = Math.max(
+    MIN_DIRS_PER_PROJECT,
+    Math.min(MAX_DIRS_PER_PROJECT, MAX_DIRS_TOTAL - totalCoveredDirs()),
+  );
   const entry: WatchEntry = {
     tree: new WatchTree({
       root: projectPath,

package/src/services/fs-credential-path-guard.ts

@@ -0,0 +1,103 @@
+import { resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { getPpmDir } from "./ppm-dir.ts";
+import { getUploadsDir } from "./chat-upload-storage.service.ts";
+import { realPathOrSelf } from "./fs-ops/fs-real-path.ts";
+
+/**
+ * Every path a generic filesystem route (read, write, copy, move, upload,
+ * trash…) must refuse because it holds credential material: the PPM config
+ * DB (provider keys, auth token) and `~/.cloudflared` (the Cloudflare login
+ * cert). Split out of `fs-path-guard.service.ts` so this one seam — "is this
+ * a credential path" — stays a single file instead of growing alongside the
+ * platform-allowlist and protected-root logic that lives there.
+ */
+
+/** Case-insensitive prefix test on Windows/macOS-style paths. */
+function isInside(child: string, parent: string): boolean {
+  const norm = (p: string) => (process.platform === "win32" ? p.toLowerCase() : p);
+  const c = norm(child);
+  const p = norm(parent);
+  return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep);
+}
+
+/** True when the path is the PPM directory or anything inside it. */
+export function isPpmDirPath(resolved: string): boolean {
+  return isInside(resolved, getPpmDir());
+}
+
+/**
+ * Chat attachments the user uploaded through the UI. They sit under the PPM
+ * dir so chat history keeps resolving them across reboots, but they are
+ * ordinary user content, not credential material: the transcript has to render
+ * the very image the assistant just read back from that directory.
+ */
+export function isChatUploadPath(resolved: string): boolean {
+  return isInside(resolved, getUploadsDir());
+}
+
+/**
+ * True when the path is `~/.cloudflared` or anything inside it. Real
+ * `homedir()` is a deliberate exception to the getPpmDir()-only rule (see
+ * CLAUDE.md "PPM Directory"): `cloudflared`, not PPM, decides this location,
+ * and it holds `cert.pem` — an account-level Cloudflare login credential that
+ * must never be servable through a generic file route. `isInside` is a
+ * prefix match against this exact resolved path, not a substring test, so an
+ * unrelated folder that merely contains ".cloudflared" as a path segment
+ * elsewhere does not match.
+ */
+export function isCloudflaredDirPath(resolved: string): boolean {
+  return isInside(resolved, resolve(homedir(), ".cloudflared"));
+}
+
+/** True when the path holds credential material a generic file route must never serve or relocate. */
+export function isCredentialPath(resolved: string): boolean {
+  return isPpmDirPath(resolved) || isCloudflaredDirPath(resolved);
+}
+
+/**
+ * Refuse the PPM directory subtree and `~/.cloudflared` on read-style doors.
+ * The former stores the config database with provider credentials and auth
+ * tokens; the latter stores the Cloudflare login cert. Neither may be
+ * downloadable through a generic file route.
+ *
+ * Chat uploads are the one exception, and only for the PPM-dir branch — chat
+ * uploads always live under `getPpmDir()`, never under `~/.cloudflared`, so
+ * the exception is a no-op for the cloudflared branch. Every caller applies
+ * this to the requested path *and* to its real path, so a symlink parked in
+ * the uploads directory still fails on the second call and cannot reach the
+ * rest of the PPM dir through the exception, and a symlink pointing at
+ * `~/.cloudflared/cert.pem` fails the same way.
+ */
+export function assertNotPpmDir(resolved: string): void {
+  if (isCredentialPath(resolved) && !isChatUploadPath(resolved)) {
+    throw Object.assign(new Error("Access denied"), { status: 403, code: "EDENIED" });
+  }
+}
+
+/**
+ * Refuse operations that would relocate a credential directory's contents
+ * anywhere else — copy, move, rename, upload-over, trash. Reading a
+ * credential path is already blocked by `assertNotPpmDir`, so without this a
+ * copy to a public path followed by an ordinary read would still hand out
+ * the PPM config DB or the Cloudflare login cert; every write/transfer door
+ * in `fs-ops/` calls this on both the source and the destination.
+ */
+export function assertNotPpmSubtree(candidate: string): void {
+  if (isCredentialPath(candidate)) {
+    throw Object.assign(new Error(`Refusing to operate on a credential directory: ${candidate}`), {
+      status: 403,
+      code: "EPROTECTED",
+    });
+  }
+}
+
+/**
+ * Same refusal, applied to the real path as well. A path that does not exist
+ * yet is still resolved through its parents, so a symlinked directory cannot
+ * be used to reach — or create something inside — a credential directory.
+ */
+export async function assertNotPpmSubtreeDeep(candidate: string): Promise<void> {
+  assertNotPpmSubtree(candidate);
+  assertNotPpmSubtree(await realPathOrSelf(candidate));
+}

package/src/services/fs-path-guard.service.ts

@@ -1,14 +1,26 @@
-import { resolve, sep } from "node:path";
+import { resolve } from "node:path";
 import { lstat, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { getPpmDir } from "./ppm-dir.ts";
-import { getUploadsDir } from "./chat-upload-storage.service.ts";
 import { realPathOrSelf, realPathOrSelfSync } from "./fs-ops/fs-real-path.ts";
 
 // Re-exported so callers reach both the guards and the resolver they build on
 // through one import.
 export { realPathOrSelf, realPathOrSelfSync };
 
+// The credential-path predicates (PPM dir + ~/.cloudflared) live in their own
+// module so this file stays focused on the platform allowlist and protected
+// roots; re-exported here so every existing caller keeps a single import.
+export {
+  isPpmDirPath,
+  isChatUploadPath,
+  isCloudflaredDirPath,
+  isCredentialPath,
+  assertNotPpmDir,
+  assertNotPpmSubtree,
+  assertNotPpmSubtreeDeep,
+} from "./fs-credential-path-guard.ts";
+
 /**
  * Central guard for every filesystem route that works outside project scope.
  * The whole disk is browsable behind PPM auth, so the remaining defences are:
@@ -38,14 +50,6 @@ export function resolvePath(input: string): string {
   return resolve(input);
 }
 
-/** Case-insensitive prefix test on Windows/macOS-style paths. */
-function isInside(child: string, parent: string): boolean {
-  const norm = (p: string) => (process.platform === "win32" ? p.toLowerCase() : p);
-  const c = norm(child);
-  const p = norm(parent);
-  return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep);
-}
-
 /**
  * Whitelist for system-level access. POSIX exposes the whole tree; Windows
  * requires a drive letter, which keeps UNC shares (`\\server\share`) out —
@@ -80,62 +84,6 @@ export function assertAllowed(resolved: string): void {
   }
 }
 
-/** True when the path is the PPM directory or anything inside it. */
-export function isPpmDirPath(resolved: string): boolean {
-  return isInside(resolved, getPpmDir());
-}
-
-/**
- * Chat attachments the user uploaded through the UI. They sit under the PPM
- * dir so chat history keeps resolving them across reboots, but they are
- * ordinary user content, not credential material: the transcript has to render
- * the very image the assistant just read back from that directory.
- */
-export function isChatUploadPath(resolved: string): boolean {
-  return isInside(resolved, getUploadsDir());
-}
-
-/**
- * Refuse the PPM directory subtree on read-style doors. It stores the config
- * database with provider credentials and auth tokens, which must never be
- * downloadable through a generic file route.
- *
- * Chat uploads are the one exception. Every caller applies this to the
- * requested path *and* to its real path, so a symlink parked in the uploads
- * directory still fails on the second call and cannot reach the rest of the
- * PPM dir through the exception.
- */
-export function assertNotPpmDir(resolved: string): void {
-  if (isPpmDirPath(resolved) && !isChatUploadPath(resolved)) {
-    throw Object.assign(new Error("Access denied"), { status: 403, code: "EDENIED" });
-  }
-}
-
-/**
- * Refuse operations that would take the PPM directory's contents anywhere
- * else. Reading that subtree is already blocked, so without this a copy to a
- * public path followed by an ordinary read would still hand out the
- * credentials database.
- */
-export function assertNotPpmSubtree(candidate: string): void {
-  if (isPpmDirPath(candidate)) {
-    throw Object.assign(new Error(`Refusing to operate on the PPM directory: ${candidate}`), {
-      status: 403,
-      code: "EPROTECTED",
-    });
-  }
-}
-
-/**
- * Same refusal, applied to the real path as well. A path that does not exist
- * yet is still resolved through its parents, so a symlinked directory cannot
- * be used to reach — or create something inside — the PPM directory.
- */
-export async function assertNotPpmSubtreeDeep(candidate: string): Promise<void> {
-  assertNotPpmSubtree(candidate);
-  assertNotPpmSubtree(await realPathOrSelf(candidate));
-}
-
 /** Paths whose removal or rename would break the host or PPM itself. */
 export function isProtectedRoot(candidate: string): boolean {
   const p = resolve(candidate);

package/src/services/named-tunnel/cloudflare-dns-api.ts

@@ -0,0 +1,40 @@
+/**
+ * Cloudflare REST calls the setup flow needs beyond what cloudflared's own
+ * CLI exposes: looking up an existing tunnel's UUID by name (so the DNS
+ * collision check can tell "already ours" from "someone else's" before
+ * `tunnel create` has even run) and reading a zone's DNS records for a
+ * candidate hostname.
+ */
+
+const TIMEOUT_MS = 10_000;
+
+export interface DnsRecord {
+  content: string;
+}
+
+async function cfGet<T extends { success?: boolean }>(url: string, apiToken: string): Promise<T> {
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${apiToken}` },
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+  const json = (await res.json().catch(() => null)) as T | null;
+  if (!res.ok || !json || json.success !== true) {
+    throw new Error(`Cloudflare API call failed (HTTP ${res.status})`);
+  }
+  return json;
+}
+
+/** DNS records at `zoneID` matching `name` exactly (empty when none exist). */
+export async function fetchDnsRecords(zoneID: string, apiToken: string, name: string): Promise<DnsRecord[]> {
+  const url = `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(zoneID)}/dns_records?name=${encodeURIComponent(name)}`;
+  const json = await cfGet<{ success: true; result?: DnsRecord[] }>(url, apiToken);
+  return Array.isArray(json.result) ? json.result : [];
+}
+
+/** UUID of an existing, non-deleted tunnel named `name` — null if none exists yet. */
+export async function fetchTunnelIdByName(accountID: string, apiToken: string, name: string): Promise<string | null> {
+  const url = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountID)}/cfd_tunnel?name=${encodeURIComponent(name)}&is_deleted=false`;
+  const json = await cfGet<{ success: true; result?: Array<{ id?: string }> }>(url, apiToken);
+  const found = (json.result ?? []).find((t) => typeof t.id === "string" && t.id);
+  return found?.id ?? null;
+}

package/src/services/named-tunnel/cloudflare-zone-api.ts

@@ -0,0 +1,28 @@
+/**
+ * Resolve the zone name behind a `zoneID`, using the `apiToken` embedded in the
+ * user's origin cert — this avoids asking the user to type a hostname; PPM
+ * proposes `ppm.<zone>` from data it already has.
+ */
+
+/** 10s bound so a hung Cloudflare API call never wedges setup indefinitely. */
+const TIMEOUT_MS = 10_000;
+
+export async function fetchZoneName(zoneID: string, apiToken: string): Promise<string> {
+  const url = `https://api.cloudflare.com/client/v4/zones/${encodeURIComponent(zoneID)}`;
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${apiToken}` },
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+
+  let json: { success?: boolean; result?: { name?: string } } | null = null;
+  try {
+    json = await res.json();
+  } catch {
+    json = null;
+  }
+
+  if (!res.ok || !json || json.success !== true || typeof json.result?.name !== "string" || !json.result.name) {
+    throw new Error(`Cloudflare rejected the certificate token (HTTP ${res.status}) — log in again`);
+  }
+  return json.result.name;
+}