@hienlh/ppm 0.8.73 → 0.8.75

package/CHANGELOG.md

@@ -1,9 +1,15 @@
 # Changelog
 
-## [0.8.73] - 2026-04-01
+## [0.8.75] - 2026-04-01
+
+### Changed
+- **Tunnel always enabled**: `ppm start` now always starts Cloudflare tunnel — `--share` flag deprecated (still accepted, no-op)
+
+## [0.8.74] - 2026-04-01
 
 ### Fixed
-- **Cloud WS reconnect loop**: Stale WebSocket closure handlers from replaced connections no longer reset module state — prevents infinite reconnect cycle after upgrade/restart
+- **Cloud WS reconnect loop**: Stale WebSocket closure handlers from replaced connections no longer reset module state
+- **Cloud WS auth race**: Delay heartbeat/queue flush 500ms after auth to let server complete async DB auth — prevents 4002 rejection
 
 ## [0.8.72] - 2026-03-31
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.8.73",
+  "version": "0.8.75",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/cli/commands/autostart.ts

@@ -10,7 +10,7 @@ export function registerAutoStartCommands(program: Command): void {
     .command("enable")
     .description("Register PPM to start automatically on boot")
     .option("-p, --port <port>", "Override port")
-    .option("-s, --share", "Enable Cloudflare tunnel on boot")
+    .option("-s, --share", "(deprecated) Tunnel is now always enabled")
     .option("-c, --config <path>", "Config file path")
     .option("--profile <name>", "DB profile name")
     .action(async (options) => {

package/src/index.ts

@@ -16,7 +16,7 @@ program
   .command("start")
   .description("Start the PPM server (background by default)")
   .option("-p, --port <port>", "Port to listen on")
-  .option("-s, --share", "Share via public URL (Cloudflare tunnel)")
+  .option("-s, --share", "(deprecated) Tunnel is now always enabled")
   .option("-c, --config <path>", "Path to config file (YAML import into DB)")
   .option("--profile <name>", "DB profile name (e.g. 'dev' → ppm.dev.db)")
   .action(async (options) => {

package/src/server/index.ts

@@ -164,6 +164,9 @@ export async function startServer(options: {
   config?: string;
   profile?: string;
 }) {
+  // Tunnel always enabled — cloudflared shares the server publicly
+  options.share = true;
+
   // Load config
   configService.load(options.config);
   const port = parseInt(options.port ?? String(configService.get("port")), 10);

package/src/services/cloud-ws.service.ts

@@ -18,6 +18,7 @@ interface HeartbeatMsg extends WsMessage {
   tunnelUrl: string | null;
   state: string;
   appVersion: string;
+  availableVersion: string | null;
   serverPid: number | null;
   uptime: number;
 }
@@ -140,8 +141,10 @@ function doConnect(): void {
   sock.onopen = () => {
     if (ws !== sock) return; // stale — newer connection replaced us
     reconnecting = false;
+    reconnectAttempt = 0;
     log("INFO", "Cloud WS connected, sending auth");
 
+    // Send auth as first message — server must process this before any other msg
     sock.send(JSON.stringify({
       type: "auth",
       deviceId,
@@ -150,23 +153,28 @@ function doConnect(): void {
       version: 1,
     }));
 
-    connected = true;
-    reconnectAttempt = 0;
-
-    // Flush queued messages
-    while (outboundQueue.length > 0 && connected) {
-      const msg = outboundQueue.shift()!;
-      sock.send(JSON.stringify(msg));
-    }
+    // Delay setting connected + sending heartbeat to let server process auth.
+    // Server's authenticateDevice() is async (DB lookup), so messages sent
+    // immediately after auth arrive before authenticated=true → 4002 reject.
+    setTimeout(() => {
+      if (ws !== sock) return; // replaced during delay
+      connected = true;
+
+      // Flush queued messages
+      while (outboundQueue.length > 0 && connected) {
+        const msg = outboundQueue.shift()!;
+        sock.send(JSON.stringify(msg));
+      }
 
-    // Send immediate heartbeat
-    if (getHeartbeatData) send(getHeartbeatData());
+      // Send immediate heartbeat
+      if (getHeartbeatData) send(getHeartbeatData());
 
-    // Start periodic heartbeat
-    if (heartbeatTimer) clearInterval(heartbeatTimer);
-    heartbeatTimer = setInterval(() => {
-      if (getHeartbeatData && connected) send(getHeartbeatData());
-    }, HEARTBEAT_INTERVAL_MS);
+      // Start periodic heartbeat
+      if (heartbeatTimer) clearInterval(heartbeatTimer);
+      heartbeatTimer = setInterval(() => {
+        if (getHeartbeatData && connected) send(getHeartbeatData());
+      }, HEARTBEAT_INTERVAL_MS);
+    }, 500); // 500ms for DB auth round-trip
   };
 
   sock.onmessage = (event) => {

package/src/services/supervisor.ts

@@ -456,6 +456,7 @@ async function connectCloud(opts: { port: number }, serverArgs: string[], logFd:
         tunnelUrl,
         state: supervisorState,
         appVersion: VERSION,
+        availableVersion: (readStatus().availableVersion as string) || null,
         serverPid: serverChild?.pid ?? null,
         uptime: Math.floor((Date.now() - startTime) / 1000),
         timestamp: new Date().toISOString(),