@hienlh/ppm 0.23.11 → 0.23.13

package/src/services/tailscale/tailscale-app-service.ts

@@ -0,0 +1,239 @@
+/**
+ * PPM at a private address on the tailnet: the Tailscale Service `svc:<name>` answers at
+ * `https://<name>.<tailnet>.ts.net` and proxies to PPM on this machine.
+ *
+ * The handler is set in the BACKGROUND (`--bg`, which `--service` requires): tailscaled
+ * keeps it across PPM restarts and reboots, so the address keeps working whatever PPM is
+ * doing. PPM's switch is therefore a desired state, re-applied when the server starts.
+ *
+ * PPM never takes over a service it did not set up: a `svc:<name>` already pointing
+ * somewhere else is reported as a conflict, and replaced only when asked; turning PPM's
+ * switch off clears the service only while it still points at PPM. That is also what keeps
+ * a dev instance and the real one on the same machine from fighting over one name.
+ */
+import { configService } from "../config.service.ts";
+import { getConfigValue, setConfigValue } from "../db.service.ts";
+import { readStatus } from "../supervisor-state.ts";
+import { broadcastGlobalEvent } from "../../server/ws/global.ts";
+import { hostCli, isAccessDenied, type TailscaleCli } from "./tailscale-cli.ts";
+import { readTailscaleSetup } from "./tailscale-state.ts";
+import { blockingSetupStep, DEFAULT_SERVICE_NAME, serviceNameProblem, type TailscaleSetupState } from "../../shared/tailscale-setup.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("tailscale");
+
+const SETTING_KEY = "tailscale_service";
+
+export interface TailscaleServiceSetting {
+  /** null: the switch was never used, so an address already pointing at PPM counts as on. */
+  enabled: boolean | null;
+  name: string;
+  /** The target PPM last set, so a later start can tell its own stale handler from someone else's. */
+  target: string | null;
+}
+
+export class TailscaleServiceError extends Error {
+  constructor(
+    message: string,
+    readonly status: 400 | 403 | 409 | 500 = 500,
+    /** "conflict": the name serves something else, which `replace` would take over. */
+    readonly code?: "conflict",
+  ) {
+    super(message);
+  }
+}
+
+export function readServiceSetting(): TailscaleServiceSetting {
+  try {
+    const raw = JSON.parse(getConfigValue(SETTING_KEY) ?? "{}") as Partial<TailscaleServiceSetting>;
+    const name = typeof raw.name === "string" && !serviceNameProblem(raw.name) ? raw.name : DEFAULT_SERVICE_NAME;
+    const enabled = typeof raw.enabled === "boolean" ? raw.enabled : null;
+    return { enabled, name, target: typeof raw.target === "string" ? raw.target : null };
+  } catch {
+    return { enabled: null, name: DEFAULT_SERVICE_NAME, target: null };
+  }
+}
+
+function writeServiceSetting(setting: TailscaleServiceSetting): void {
+  setConfigValue(SETTING_KEY, JSON.stringify(setting));
+}
+
+let publicPort: number | null = null;
+
+/**
+ * Record the port people reach PPM on. Under the supervisor the server binds port 0 and
+ * the edge forwarder owns the public port (in status.json), which outlives every server
+ * restart; a server started on a fixed port (dev, `__serve__ <port>`) serves it itself.
+ */
+export function setPpmPublicPort(spawnPort: number, boundPort: number): void {
+  if (spawnPort !== 0) { publicPort = boundPort; return; }
+  const supervised = Number(readStatus().port);
+  publicPort = Number.isInteger(supervised) && supervised > 0 ? supervised : null;
+}
+
+export function ppmPublicPort(): number {
+  return publicPort ?? configService.get("port") ?? 8080;
+}
+
+const targetFor = (port: number) => `http://127.0.0.1:${port}`;
+
+function announce(): void {
+  broadcastGlobalEvent({ type: "tailscale:changed" });
+}
+
+/** The pane's state, for the saved name or for a name being typed. */
+export async function readState(name?: string, cli: TailscaleCli = hostCli()): Promise<TailscaleSetupState> {
+  const setting = readServiceSetting();
+  const candidate = name && !serviceNameProblem(name) ? name : setting.name;
+  const saved = candidate === setting.name;
+  const state = await readTailscaleSetup({ serviceName: candidate, enabled: saved && setting.enabled === true, ppmPort: ppmPublicPort() }, cli);
+  // An address someone set up by hand before PPM had this switch is on until the switch is used.
+  if (saved && setting.enabled === null && state.service.pointsAtPpm) return { ...state, enabled: true };
+  return state;
+}
+
+const MISSING: Record<NonNullable<ReturnType<typeof blockingSetupStep>>, string> = {
+  install: "Install Tailscale on this machine first.",
+  start: "Start Tailscale on this machine first.",
+  operator: "Let PPM manage Tailscale first: run the operator command shown in Settings.",
+  "sign-in": "Sign this machine in to Tailscale first.",
+  dns: "Turn on MagicDNS and HTTPS certificates for your tailnet first.",
+  tag: "Tag this machine first: Tailscale only lets tagged machines host a service.",
+};
+
+/** What still stands between this machine and hosting a service, or null. */
+export function missingForService(state: TailscaleSetupState): string | null {
+  const step = blockingSetupStep(state);
+  return step ? MISSING[step] : null;
+}
+
+/** The CLI's refusal, in terms of the step that fixes it. */
+export function serviceFailureMessage(stderr: string): string {
+  if (isAccessDenied(stderr)) return "Tailscale refused to let PPM change its settings. Run the operator command shown in Settings, then try again.";
+  if (/must be tagged/i.test(stderr)) return "Tailscale only lets tagged machines host a service. Tag this machine, then try again.";
+  const text = stderr.trim().split("\n").filter(Boolean).slice(0, 3).join(" ");
+  return text ? `tailscale serve failed: ${text}` : "tailscale serve failed";
+}
+
+async function serve(cli: TailscaleCli, args: string[]): Promise<void> {
+  const result = await cli.runner([...cli.argv!, "serve", ...args], 20_000);
+  if (result.code !== 0) throw new TailscaleServiceError(serviceFailureMessage(result.stderr || result.stdout));
+}
+
+const serviceArgs = (name: string, target: string) => [`--service=svc:${name}`, "--https=443", "--bg", "--yes", target];
+
+/** Point `svc:<name>` at this PPM and remember the switch is on. */
+export async function enableService(
+  opts: { name?: string; replace?: boolean },
+  cli: TailscaleCli = hostCli(),
+): Promise<TailscaleSetupState> {
+  const setting = readServiceSetting();
+  const name = opts.name ?? setting.name;
+  const problem = serviceNameProblem(name);
+  if (problem) throw new TailscaleServiceError(problem, 400);
+  if (!configService.get("auth").enabled) {
+    throw new TailscaleServiceError("Turn on PPM's password first: anyone in your tailnet could otherwise open PPM.", 403);
+  }
+
+  const state = await readState(name, cli);
+  const missing = missingForService(state);
+  if (missing) throw new TailscaleServiceError(missing, 409);
+  const foreign = !!state.service.target && !state.service.pointsAtPpm && state.service.target !== setting.target;
+  if (foreign && !opts.replace) {
+    throw new TailscaleServiceError(`svc:${name} already serves ${state.service.target}. Choose another name, or replace it.`, 409, "conflict");
+  }
+
+  const target = targetFor(state.ppmPort);
+  await serve(cli, serviceArgs(name, target));
+  // Moved to a new name: drop the old service once the new one is set, and only while it
+  // is still PPM's. A failure above leaves both the old service and the setting as they were.
+  const moved = !!setting.enabled && setting.name !== name;
+  if (moved) {
+    // Left behind, the old service keeps pointing at PPM under a name nobody manages.
+    await clearIfOurs(setting, cli).catch((e) => log.warn(`Could not clear previous svc:${setting.name}: ${(e as Error).message}`));
+  }
+  writeServiceSetting({ enabled: true, name, target });
+  log.info(`Tailscale svc:${name} → ${target} enabled (replaced=${foreign}${moved ? `, moved from svc:${setting.name}` : ""})`);
+  announce();
+  return readState(name, cli);
+}
+
+/** Clears `svc:<name>` only while it still points at PPM; returns whether it did. */
+async function clearIfOurs(setting: TailscaleServiceSetting, cli: TailscaleCli): Promise<boolean> {
+  const state = await readState(setting.name, cli);
+  const ours = state.service.target !== null && (state.service.pointsAtPpm || state.service.target === setting.target);
+  if (ours) await serve(cli, ["clear", `svc:${setting.name}`]);
+  return ours;
+}
+
+/** Take PPM off its address and remember the switch is off. */
+export async function disableService(cli: TailscaleCli = hostCli()): Promise<TailscaleSetupState> {
+  const setting = readServiceSetting();
+  const cleared = cli.argv ? await clearIfOurs(setting, cli) : false;
+  writeServiceSetting({ ...readServiceSetting(), enabled: false });
+  log.info(`Tailscale svc:${setting.name} disabled (cleared=${cleared})`);
+  announce();
+  return readState(setting.name, cli);
+}
+
+/** Change the name while the switch is off (it names the service the setup steps describe). */
+export async function renameService(name: string, cli: TailscaleCli = hostCli()): Promise<TailscaleSetupState> {
+  const problem = serviceNameProblem(name);
+  if (problem) throw new TailscaleServiceError(problem, 400);
+  if (readServiceSetting().name !== name && (await readState(undefined, cli)).enabled) {
+    throw new TailscaleServiceError("Turn the address off before renaming it.", 409);
+  }
+  // Read again: the switch may have moved while the CLI answered.
+  writeServiceSetting({ ...readServiceSetting(), name });
+  return readState(name, cli);
+}
+
+/**
+ * At server start: if the switch is on, make the service point at this PPM again. Waits
+ * for tailscaled to be up (a machine booting starts PPM before Tailscale has connected),
+ * and leaves a service alone that someone else has since pointed elsewhere.
+ */
+export async function ensureServiceOnStartup(
+  opts: { cli?: TailscaleCli; attempts?: number; delayMs?: number } = {},
+): Promise<"off" | "ok" | "applied" | "foreign" | "unavailable" | "failed"> {
+  const cli = opts.cli ?? hostCli();
+  const setting = readServiceSetting();
+  if (!setting.enabled || !cli.argv) return "off";
+  const attempts = opts.attempts ?? 40;
+  const delayMs = opts.delayMs ?? 15_000;
+  let lastBackend: string | null = null;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (attempt > 0) await Bun.sleep(delayMs);
+    if (!readServiceSetting().enabled) return "off";
+    const state = await readState(setting.name, cli);
+    lastBackend = state.backendState;
+    if (state.backendState !== "Running") continue;
+    if (state.service.pointsAtPpm) return "ok";
+    if (state.service.target && state.service.target !== setting.target) {
+      log.warn(`svc:${setting.name} now serves ${state.service.target}; leaving it alone`);
+      return "foreign";
+    }
+    // The caller does not act on the answer, so a give-up has to say why here.
+    const missing = missingForService(state);
+    if (missing) {
+      log.warn(`svc:${setting.name} not re-applied at startup: ${missing}`);
+      return "unavailable";
+    }
+    try {
+      const target = targetFor(state.ppmPort);
+      await serve(cli, serviceArgs(setting.name, target));
+      writeServiceSetting({ ...readServiceSetting(), target });
+      announce();
+      log.info(`svc:${setting.name} → ${target}`);
+      return "applied";
+    } catch (e) {
+      log.error(`Could not point svc:${setting.name} at ${targetFor(state.ppmPort)}: ${(e as Error).message}`);
+      return "failed";
+    }
+  }
+  log.warn(`svc:${setting.name} not re-applied at startup: tailscaled not Running after ${attempts} checks over ${Math.round(((attempts - 1) * delayMs) / 1000)}s (last state: ${lastBackend ?? "unknown"})`);
+  return "unavailable";
+}
+
+/** The seam route tests patch. */
+export const tailscaleAppService = { readState, enableService, disableService, renameService };

package/src/services/tailscale/tailscale-cli.ts

@@ -0,0 +1,48 @@
+/**
+ * Finding and calling the `tailscale` CLI. PPM never talks to tailscaled's LocalAPI
+ * directly: the socket, its authentication and its path differ on every OS (a unix socket
+ * with peer credentials on Linux, the GUI app's port and token on macOS, a named pipe on
+ * Windows), and the CLI already knows all three.
+ */
+import { existsSync } from "node:fs";
+import { defaultRunner, type Runner } from "../host-info/spawn-runner.ts";
+
+const MAC_CANDIDATES = [
+  "/opt/homebrew/bin/tailscale",
+  "/usr/local/bin/tailscale",
+  // The standalone and App Store apps ship the CLI inside the bundle.
+  "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+];
+const WINDOWS_CANDIDATES = ["C:\\Program Files\\Tailscale\\tailscale.exe"];
+
+/** The tailscale CLI, also where a launchd- or service-started PPM's PATH would not find it. */
+export function tailscaleBinary(): string | null {
+  const onPath = Bun.which("tailscale");
+  if (onPath) return onPath;
+  const candidates = process.platform === "darwin" ? MAC_CANDIDATES : process.platform === "win32" ? WINDOWS_CANDIDATES : [];
+  return candidates.find((p) => existsSync(p)) ?? null;
+}
+
+/** How PPM runs the CLI: the host's binary, or in tests a fake run through bun. */
+export interface TailscaleCli {
+  /** The command as an argv prefix, or null when Tailscale is not installed. */
+  argv: string[] | null;
+  runner: Runner;
+}
+
+export function hostCli(): TailscaleCli {
+  const bin = tailscaleBinary();
+  return { argv: bin ? [bin] : null, runner: defaultRunner };
+}
+
+/** Run a CLI command that prints JSON; throws with the CLI's own message when it fails. */
+export async function runJson(runner: Runner, argv: string[], timeoutMs = 4000): Promise<unknown> {
+  const result = await runner(argv, timeoutMs);
+  if (result.code !== 0) throw new Error(result.stderr.trim() || `${argv.slice(1).join(" ")} failed`);
+  return JSON.parse(result.stdout);
+}
+
+/** tailscaled refuses a change from a user who is neither root nor its operator (Linux). */
+export function isAccessDenied(output: string): boolean {
+  return /access denied|permission denied|not allowed/i.test(output);
+}

package/src/services/tailscale/tailscale-login.ts

@@ -0,0 +1,257 @@
+/**
+ * Signing this machine in to Tailscale from the settings pane: `tailscale up --json`
+ * prints the sign-in link (and a QR code) as JSON, then `{"BackendState":"Running"}` once
+ * the person has finished in their browser, and exits.
+ *
+ * Two traps in that command. `tailscale up` refuses to run when the node already has
+ * settings the command line does not repeat ("changing settings via 'tailscale up'
+ * requires mentioning all non-default flags"), so a node signed in before (an operator, a
+ * tag, a hostname) cannot simply be signed in again with `tailscale up`. The refusal
+ * prints the exact command that keeps every current setting, which is retried once.
+ * And a node that is merely turned off must get a *bare* `tailscale up`: any flag,
+ * `--json` included, takes it off that path and into the same refusal.
+ *
+ * One sign-in at a time; a second start while one is waiting returns it. Every terminal
+ * state drops the process, so the next start gets a fresh link.
+ */
+import { broadcastGlobalEvent } from "../../server/ws/global.ts";
+import { hostCli, isAccessDenied, runJson, type TailscaleCli } from "./tailscale-cli.ts";
+import { parseStatus } from "./tailscale-state.ts";
+import type { TailscaleLoginSnapshot, TailscaleLoginState } from "../../shared/tailscale-setup.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("tailscale");
+
+export const LOGIN_TIMEOUT_MS = 10 * 60_000;
+
+const spawnCli = (argv: string[]) =>
+  Bun.spawn(argv, { stdout: "pipe", stderr: "pipe", stdin: "ignore", windowsHide: true });
+
+interface Session extends TailscaleLoginSnapshot {
+  proc: ReturnType<typeof spawnCli> | null;
+  killTimer: ReturnType<typeof setTimeout> | null;
+}
+
+let session: Session = { state: "idle", url: null, message: null, proc: null, killTimer: null };
+
+export function getLoginSnapshot(): TailscaleLoginSnapshot {
+  return { state: session.state, url: session.url, message: session.message };
+}
+
+function announce(): void {
+  broadcastGlobalEvent({ type: "tailscale:changed", login: getLoginSnapshot() });
+}
+
+function finish(state: TailscaleLoginState, message: string | null): void {
+  const pid = session.proc?.pid;
+  if (session.killTimer) clearTimeout(session.killTimer);
+  session = { state, url: null, message, proc: null, killTimer: null };
+  announce();
+  // The broadcast reaches only an open pane; this is the record of how the sign-in ended.
+  // Any link in the message is dropped: a sign-in link would let whoever opens it take the
+  // machine into their own tailnet.
+  const of = pid ? ` (PID ${pid})` : "";
+  const text = message ? `: ${message.replace(/https?:\/\/\S+/g, "<link>")}` : "";
+  if (state === "timeout") log.warn(`Tailscale sign-in timed out after ${LOGIN_TIMEOUT_MS / 60_000}m${of}`);
+  else if (state === "error" || state === "needs-operator") log.error(`Tailscale sign-in ${state}${of}${text}`);
+  else log.info(`Tailscale sign-in ${state}${of}${text}`);
+}
+
+/** Split one shell command line the way `shellquote.Join` built it (POSIX quoting). */
+export function splitShellWords(line: string): string[] {
+  const words: string[] = [];
+  let word = "";
+  let inWord = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i]!;
+    if (ch === "'") {
+      const end = line.indexOf("'", i + 1);
+      word += line.slice(i + 1, end === -1 ? line.length : end);
+      i = end === -1 ? line.length : end;
+      inWord = true;
+    } else if (ch === '"') {
+      i++;
+      while (i < line.length && line[i] !== '"') {
+        if (line[i] === "\\" && i + 1 < line.length) i++;
+        word += line[i];
+        i++;
+      }
+      inWord = true;
+    } else if (ch === "\\" && i + 1 < line.length) {
+      word += line[++i];
+      inWord = true;
+    } else if (/\s/.test(ch)) {
+      if (inWord) words.push(word);
+      word = "";
+      inWord = false;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (inWord) words.push(word);
+  return words;
+}
+
+/** The flags `tailscale up` asked to be repeated, or null when it refused for another reason. */
+export function flagsFromRevertRefusal(stderr: string): string[] | null {
+  if (!/requires mentioning all\s+non-default flags/.test(stderr)) return null;
+  const line = stderr.match(/\n\s*tailscale up([^\n]*)/)?.[1];
+  if (line === undefined) return null;
+  const flags = splitShellWords(line).filter((w) => w.startsWith("--"));
+  return flags.includes("--json") ? flags : ["--json", ...flags];
+}
+
+/**
+ * Pull complete JSON objects off the front of `buffer` (`tailscale up --json` writes them
+ * indented, one after another).
+ */
+export function takeJsonObjects(buffer: string): { objects: unknown[]; rest: string } {
+  const objects: unknown[] = [];
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let consumed = 0;
+  for (let i = 0; i < buffer.length; i++) {
+    const ch = buffer[i];
+    if (inString) {
+      if (ch === "\\") i++;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') inString = true;
+    else if (ch === "{") {
+      if (depth === 0) start = i;
+      depth++;
+    } else if (ch === "}" && depth > 0) {
+      depth--;
+      if (depth === 0 && start !== -1) {
+        try { objects.push(JSON.parse(buffer.slice(start, i + 1))); } catch { /* not ours */ }
+        consumed = i + 1;
+        start = -1;
+      }
+    }
+  }
+  return { objects, rest: buffer.slice(consumed) };
+}
+
+/** What a failed `tailscale up` means for the person in front of the pane. */
+export function loginFailure(stderr: string): { state: TailscaleLoginState; message: string } {
+  if (isAccessDenied(stderr)) {
+    return { state: "needs-operator", message: "Tailscale refused to let PPM sign this machine in." };
+  }
+  const text = stderr.trim().split("\n").filter(Boolean).slice(0, 3).join(" ");
+  return { state: "error", message: text || "tailscale up exited without signing in" };
+}
+
+async function readBackendState(cli: TailscaleCli): Promise<string | null> {
+  if (!cli.argv) return null;
+  const status = await runJson(cli.runner, [...cli.argv, "status", "--json"]).catch(() => null);
+  return status ? parseStatus(status).backendState : null;
+}
+
+/** Turn a signed-in machine that was switched off back on. */
+async function turnOn(cli: TailscaleCli): Promise<void> {
+  const current = session;
+  const result = await cli.runner([...cli.argv!, "up"], 30_000);
+  if (session !== current) return; // cancelled meanwhile; a newer sign-in may be running
+  if (result.code === 0) finish("success", "Tailscale is on");
+  else {
+    const failure = loginFailure(result.stderr);
+    finish(failure.state, failure.message);
+  }
+}
+
+function runInteractive(cli: TailscaleCli, flags: string[], retried: boolean): void {
+  const proc = spawnCli([...cli.argv!, "up", ...flags]);
+  session.proc = proc;
+  // Flag names only: a value is a setting of this node, and nothing a log reader needs.
+  log.info(retried
+    ? `Tailscale sign-in retried with the node's current flags (${flags.map((f) => f.split("=")[0]).join(" ")}) (PID ${proc.pid})`
+    : `Tailscale sign-in started (PID ${proc.pid})`);
+
+  const stdoutDone = (async () => {
+    const reader = proc.stdout.getReader();
+    const decoder = new TextDecoder();
+    let pending = "";
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        const taken = takeJsonObjects(pending + decoder.decode(value, { stream: true }));
+        pending = taken.rest;
+        for (const object of taken.objects) {
+          if (session.proc !== proc) return;
+          const o = object as { AuthURL?: unknown; BackendState?: unknown; Error?: unknown };
+          if (typeof o.AuthURL === "string" && o.AuthURL) {
+            session.state = "waiting";
+            session.url = o.AuthURL;
+            announce();
+          } else if (o.BackendState === "Running") {
+            finish("success", "Signed in");
+          } else if (o.BackendState === "NeedsMachineAuth") {
+            finish("needs-approval", "An admin has to approve this machine in Tailscale.");
+          } else if (typeof o.Error === "string" && o.Error) {
+            finish("error", o.Error);
+          }
+        }
+      }
+    } catch { /* killed */ }
+  })();
+  const stderrText = new Response(proc.stderr).text().catch(() => "");
+
+  void Promise.all([proc.exited, stdoutDone, stderrText]).then(([code, , stderr]) => {
+    if (session.proc !== proc) return;
+    if (code === 0) { finish("success", "Signed in"); return; }
+    const retry = retried ? null : flagsFromRevertRefusal(stderr);
+    if (retry) { runInteractive(cli, retry, true); return; }
+    const failure = loginFailure(stderr);
+    finish(failure.state, failure.message);
+  });
+}
+
+/** Start (or return the running) sign-in. */
+export async function startLogin(cli: TailscaleCli = hostCli()): Promise<TailscaleLoginSnapshot> {
+  if (session.state === "starting" || session.state === "waiting") return getLoginSnapshot();
+  if (!cli.argv) {
+    finish("error", "Tailscale is not installed on this machine.");
+    return getLoginSnapshot();
+  }
+  const current: Session = { state: "starting", url: null, message: null, proc: null, killTimer: null };
+  session = current;
+  announce();
+
+  const backend = await readBackendState(cli);
+  // The object, not its state: a cancel and a new start meanwhile leave a session that is
+  // "starting" too, and carrying on would give it a second `tailscale up` and kill timer.
+  if (session !== current) return getLoginSnapshot();
+  if (backend === "Running") { finish("success", "Already signed in"); return getLoginSnapshot(); }
+  if (backend === "NeedsMachineAuth") {
+    finish("needs-approval", "An admin has to approve this machine in Tailscale.");
+    return getLoginSnapshot();
+  }
+  if (backend === "Stopped") { await turnOn(cli); return getLoginSnapshot(); }
+
+  session.killTimer = setTimeout(() => {
+    try { session.proc?.kill(); } catch { /* gone */ }
+    finish("timeout", "The sign-in link expired. Start again for a new one.");
+  }, LOGIN_TIMEOUT_MS);
+  runInteractive(cli, ["--json"], false);
+  return getLoginSnapshot();
+}
+
+export function cancelLogin(): TailscaleLoginSnapshot {
+  if (session.proc) {
+    try { session.proc.kill(); } catch { /* gone */ }
+  }
+  finish("cancelled", null);
+  return getLoginSnapshot();
+}
+
+// A sign-in left running would keep a stale link alive after the server is gone.
+process.on("exit", () => {
+  try { session.proc?.kill(); } catch { /* gone */ }
+});
+
+/** The seam route tests patch, as `cloudflaredLoginService` is. */
+export const tailscaleLoginService = { getLoginSnapshot, startLogin, cancelLogin };