@iamken/cloudtunnel 0.1.0 → 0.1.2

package/dist/index.js

@@ -358,12 +358,21 @@ function upsertEntry(fqdn, patch) {
     const prev = reg[fqdn];
     reg[fqdn] = {
       createdAt: prev?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      index: prev?.index ?? nextIndex(reg),
       state: "provisioning",
       ...prev,
       ...patch
     };
   });
 }
+function nextIndex(reg) {
+  const used = new Set(
+    Object.values(reg).map((e) => e.index).filter((n) => typeof n === "number")
+  );
+  let i = 1;
+  while (used.has(i)) i++;
+  return i;
+}
 function patchEntry(fqdn, patch) {
   return mutateRegistry((reg) => {
     const prev = reg[fqdn];
@@ -476,6 +485,21 @@ async function getTunnel(cf, id) {
 async function deleteTunnel(cf, id) {
   await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}`);
 }
+async function cleanupConnections(cf, id) {
+  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`);
+}
+async function deleteTunnelWithConnections(cf, id) {
+  try {
+    await deleteTunnel(cf, id);
+  } catch (err) {
+    if (err instanceof CliError && /active connections/i.test(err.message)) {
+      await cleanupConnections(cf, id);
+      await deleteTunnel(cf, id);
+    } else {
+      throw err;
+    }
+  }
+}
 async function getTunnelToken(cf, id) {
   return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}/token`)).result;
 }
@@ -590,21 +614,13 @@ async function createTunnelSubdomain(cf, opts) {
   const zone = await resolveZone(cf.token, host.zone);
   const existing = await findCname(cf.token, zone.id, host.hostname);
   if (existing) {
-    if (isManagedDns(existing) && !opts.force) {
-      const tunnelId2 = tunnelIdFromCname(existing.content);
-      const token = await getTunnelToken(cf, tunnelId2);
-      await putIngress(cf, tunnelId2, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto }));
-      await recordRunning(host, zone.id, tunnelId2, existing.id, opts);
-      say.dim(`Re-attaching to existing tunnel for ${host.hostname}.`);
-      return { host, tunnelId: tunnelId2, token, adopted: true };
-    }
-    if (!opts.force) {
-      throw new CliError(`${host.hostname} is already taken by a record not managed by cloudtunnel.`, {
-        hint: "pick another --subdomain/--hostname, or pass -f/--force to take it over"
+    const isTunnelRecord = existing.content.endsWith(".cfargotunnel.com");
+    if (!isTunnelRecord && !opts.force) {
+      throw new CliError(`${host.hostname} is taken by a non-tunnel DNS record.`, {
+        hint: "pick another --subdomain/--hostname, or pass -f/--force to replace it"
       });
     }
     await releaseHostname(cf, zone.id, existing);
-    say.dim(`Released ${host.hostname} (--force) \u2014 recreating.`);
   }
   await upsertEntry(host.hostname, {
     subdomain: host.subdomain,
@@ -625,7 +641,7 @@ async function createTunnelSubdomain(cf, opts) {
     const record = await createCname(cf.token, zone.id, host.hostname, tunnelId);
     dnsRecordId = record.id;
     await recordRunning(host, zone.id, tunnelId, dnsRecordId, opts);
-    return { host, tunnelId, token, adopted: false };
+    return { host, tunnelId, token };
   } catch (err) {
     const clean = await rollback(cf, zone.id, tunnelId, dnsRecordId, host.hostname);
     if (clean) await removeEntry(host.hostname);
@@ -651,7 +667,7 @@ async function releaseHostname(cf, zoneId, record) {
     const oldTunnelId = tunnelIdFromCname(record.content);
     try {
       const tunnel = await getTunnel(cf, oldTunnelId);
-      if (isManagedTunnel(tunnel)) await deleteTunnel(cf, oldTunnelId);
+      if (isManagedTunnel(tunnel)) await deleteTunnelWithConnections(cf, oldTunnelId);
     } catch {
     }
   }
@@ -664,7 +680,7 @@ async function rollback(cf, zoneId, tunnelId, dnsRecordId, hostname) {
       await deleteDnsRecord(cf.token, zoneId, dnsRecordId);
     } catch {
       clean = false;
-      say.warn(`Left a DNS record behind for ${hostname} (${dnsRecordId}) \u2014 run \`cloudtunnel rm --force ${hostname}\`.`);
+      say.warn(`Left a DNS record behind for ${hostname} (${dnsRecordId}).`);
     }
   }
   if (tunnelId) {
@@ -672,7 +688,7 @@ async function rollback(cf, zoneId, tunnelId, dnsRecordId, hostname) {
       await deleteTunnel(cf, tunnelId);
     } catch {
       clean = false;
-      say.warn(`Left tunnel ${tunnelId} behind \u2014 run \`cloudtunnel gc\`.`);
+      say.warn(`Left tunnel ${tunnelId} behind \u2014 remove it with \`cloudtunnel down ${hostname}\`.`);
     }
   }
   return clean;
@@ -684,29 +700,37 @@ var isNotFound = (err) => err instanceof CliError && err.status === 404;
 var zoneFromFqdn = (fqdn) => fqdn.slice(fqdn.indexOf(".") + 1);
 function resolveTarget(target) {
   if (target.includes(".")) return { fqdn: target, entry: getEntry(target) };
-  const matches = listEntries().filter((e) => e.subdomain === target);
+  const entries = listEntries();
+  if (/^\d+$/.test(target)) {
+    const byIndex = entries.find((e) => e.index === Number(target));
+    if (byIndex) return { fqdn: `${byIndex.subdomain}.${byIndex.zone}`, entry: byIndex };
+  }
+  const byId = entries.filter((e) => e.tunnelId?.startsWith(target));
+  const matches = byId.length > 0 ? byId : entries.filter((e) => e.subdomain === target);
   if (matches.length > 1) {
-    throw new CliError(`"${target}" matches multiple zones.`, {
-      hint: `use the full hostname: ${matches.map((m) => `${m.subdomain}.${m.zone}`).join(", ")}`
+    throw new CliError(`"${target}" matches multiple subdomains.`, {
+      hint: `use a full hostname or a longer id: ${matches.map((m) => `${m.subdomain}.${m.zone}`).join(", ")}`
     });
   }
   const entry = matches[0];
-  if (!entry) throw new CliError(`No tracked subdomain named "${target}".`, { hint: "pass a full hostname" });
+  if (!entry) {
+    throw new CliError(`No tracked subdomain matching "${target}".`, { hint: "see `cloudtunnel ls` for the #, name, or id" });
+  }
   return { fqdn: `${entry.subdomain}.${entry.zone}`, entry };
 }
 async function removeTunnelSubdomain(cf, target, opts = {}) {
   const { fqdn, entry } = resolveTarget(target);
   if (!entry && !opts.force) {
-    throw new CliError(`${fqdn} is not managed by cloudtunnel.`, { hint: "pass --force to delete it anyway" });
+    throw new CliError(`${fqdn} is not managed by cloudtunnel.`, { hint: "pass --force to release it anyway" });
   }
   const zoneId = entry?.zoneId ?? (await resolveZone(cf.token, zoneFromFqdn(fqdn))).id;
   const record = await findCname(cf.token, zoneId, fqdn);
   if (record && !isManagedDns(record) && !opts.force) {
-    throw new CliError(`${fqdn} points to a record not managed by cloudtunnel.`, { hint: "pass --force to delete it" });
+    throw new CliError(`${fqdn} points to a record not managed by cloudtunnel.`, { hint: "pass --force to release it" });
   }
   const tunnelId = record ? tunnelIdFromCname2(record.content) : entry?.tunnelId;
   if (opts.dryRun) {
-    say.info(`Would delete: tunnel ${tunnelId ?? "(none)"}${record && !opts.keepDns ? `, DNS ${record.id}` : ""}`);
+    say.info(`Would release: tunnel ${tunnelId ?? "(none)"}${record ? `, DNS ${record.id}` : ""}`);
     return;
   }
   if (entry) await stopConnector(entry);
@@ -722,13 +746,13 @@ async function removeTunnelSubdomain(cf, target, opts = {}) {
     }
     if (tunnel) {
       try {
-        await deleteTunnel(cf, tunnelId);
+        await deleteTunnelWithConnections(cf, tunnelId);
       } catch (err) {
         if (!isNotFound(err)) throw err;
       }
     }
   }
-  if (record && !opts.keepDns) {
+  if (record) {
     try {
       await deleteDnsRecord(cf.token, zoneId, record.id);
     } catch (err) {
@@ -736,26 +760,22 @@ async function removeTunnelSubdomain(cf, target, opts = {}) {
     }
   }
   await removeEntry(fqdn);
-  say.ok(`Removed ${fqdn}`);
-}
-async function updateIngress(cf, target, port, proto) {
-  const { fqdn, entry } = resolveTarget(target);
-  if (!entry?.tunnelId) throw new CliError(`No tracked tunnel for ${fqdn}.`);
-  const nextProto = proto ?? entry.proto;
-  await putIngress(cf, entry.tunnelId, buildIngress({ hostname: fqdn, port, proto: nextProto }));
-  await patchEntry(fqdn, { port, proto: nextProto });
-  say.ok(`${fqdn} now points to ${nextProto}://localhost:${port} (no restart needed)`);
+  if (!opts.quiet) say.ok(`Released ${fqdn}`);
 }
 async function listAll(cf, opts = {}) {
   const entries = await reconcile();
   const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
-  const rows = entries.map((e) => ({
-    hostname: `${e.subdomain}.${e.zone}`,
-    zone: e.zone,
-    port: `${e.proto}://localhost:${e.port}`,
-    state: e.tunnelId && !tunnels.has(e.tunnelId) ? "dangling" : e.state,
-    managed: true
-  }));
+  const rows = entries.map((e) => {
+    const gone = e.tunnelId ? !tunnels.has(e.tunnelId) : false;
+    return {
+      num: e.index ? String(e.index) : "-",
+      hostname: `${e.subdomain}.${e.zone}`,
+      port: `${e.proto}://localhost:${e.port}`,
+      state: !gone && e.state === "running" ? "up" : "down",
+      pid: e.state === "running" && e.pid ? String(e.pid) : "-",
+      managed: true
+    };
+  });
   if (opts.all) {
     const { listCargoCnames } = await import("./dns-PAPFSYFP.js");
     const { listZones: listZones3 } = await import("./zones-YNGQYXAF.js");
@@ -763,7 +783,7 @@ async function listAll(cf, opts = {}) {
     for (const zone of await listZones3(cf.token)) {
       for (const rec of await listCargoCnames(cf.token, zone.id)) {
         if (!tracked.has(rec.name)) {
-          rows.push({ hostname: rec.name, zone: zone.name, port: "-", state: "unmanaged", managed: false });
+          rows.push({ num: "-", hostname: rec.name, port: "-", state: "unmanaged", pid: "-", managed: false });
         }
       }
     }
@@ -779,19 +799,27 @@ function parsePort(port) {
   }
   return n;
 }
-async function resolveDomain(token, explicit, saved) {
+async function resolveDomain(cf, opts, creds) {
+  if (opts.hostname) return void 0;
+  const explicit = opts.domain ?? opts.zone;
   if (explicit) return explicit;
-  if (saved) return saved;
-  const zones = await listZones(token);
+  const zones = await listZones(cf.token);
   if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
   if (zones.length === 1) return zones[0].name;
-  if (!process.stdin.isTTY) {
-    throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>, e.g. -d example.com" });
+  if (process.stdin.isTTY) return (await selectOne("Choose a domain", zones, (z) => z.name)).name;
+  if (creds.defaultZone) return creds.defaultZone;
+  throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
+}
+async function resolveSubdomain(opts) {
+  const explicit = opts.subdomain ?? opts.name;
+  if (explicit || opts.hostname) return explicit;
+  if (!process.stdin.isTTY) return void 0;
+  const input = await clack2.text({ message: "Subdomain", placeholder: "leave blank for a random name" });
+  if (clack2.isCancel(input)) {
+    clack2.cancel("Cancelled.");
+    process.exit(130);
   }
-  const chosen = await selectOne("Choose a domain", zones, (z) => z.name);
-  saveConfig({ ...loadConfig(), defaultZone: chosen.name });
-  say.dim(`Saved ${chosen.name} as your default domain (change it with \`cloudtunnel login --zone <domain>\`).`);
-  return chosen.name;
+  return input.trim() || void 0;
 }
 function showLogTail(logFile) {
   try {
@@ -805,9 +833,9 @@ async function runUp(portArg, opts) {
   const creds = await ensureAuth();
   const cf = resolveCf();
   const bin = await ensureCloudflared();
-  const subdomain = opts.subdomain ?? opts.name;
-  const domain = opts.hostname ? void 0 : await resolveDomain(cf.token, opts.domain ?? opts.zone, creds.defaultZone);
   if (process.stdout.isTTY) clack2.intro("cloudtunnel");
+  const domain = await resolveDomain(cf, opts, creds);
+  const subdomain = await resolveSubdomain(opts);
   const spin = clack2.spinner();
   let spinnerActive = true;
   const stopSpin = (msg) => {
@@ -849,14 +877,8 @@ async function runUp(portArg, opts) {
     controller.abort();
     stopSpin("Stopping\u2026");
     try {
-      const entry = getEntry(fqdn);
-      if (entry) await stopConnector(entry);
-      if (opts.ephemeral) {
-        await removeTunnelSubdomain(cf, fqdn, { force: true });
-        clack2.outro(`Stopped \xB7 ${fqdn} deleted`);
-      } else {
-        clack2.outro(`Stopped \xB7 ${fqdn} kept \u2014 re-attach: cloudtunnel ${port} -s ${result.host.subdomain}`);
-      }
+      await removeTunnelSubdomain(cf, fqdn, { force: true, quiet: true });
+      clack2.outro(`Stopped \xB7 ${fqdn} released`);
     } catch (err) {
       reportError(err);
     } finally {
@@ -884,19 +906,19 @@ async function runUp(portArg, opts) {
   if (health === "healthy") {
     stopSpin("Connected");
     clack2.note(`${formatRoute(fqdn, target)}
-${dim("Ctrl-C stops the connector \u2014 the subdomain is kept")}`, "Live");
+${dim("Ctrl-C stops and releases this subdomain")}`, "Live");
   } else if (health === "provisioning") {
     stopSpin("Provisioning");
     say.warn(`${fqdn} is not healthy yet \u2014 it should be live shortly.`);
   }
 }
 function registerUp(program) {
-  program.command("up").argument("<port>", "local port to expose (e.g. 3000)").description("Expose a local port at an HTTPS subdomain (also: `cloudtunnel <port>`)").option("-s, --subdomain <name>", "subdomain label (default: a friendly random slug)").option("-d, --domain <domain>", "domain to create the subdomain under (default: your default; picks interactively if unset)").option("--name <name>", "alias of --subdomain").option("--zone <domain>", "alias of --domain").option("--hostname <fqdn>", "full hostname override (instead of --subdomain + --domain)").option("--detach", "run the connector in the background").option("--ephemeral", "delete the tunnel + DNS on exit (nport-style; default keeps them)").option("-f, --force", "take over a subdomain already occupied by another record").option("--proto <proto>", "local service protocol: http | https", "http").action((port, opts) => runUp(port, opts));
+  program.command("up").argument("<port>", "local port to expose (e.g. 3000)").description("Expose a local port at an HTTPS subdomain (also: `cloudtunnel <port>`)").option("-s, --subdomain <name>", "subdomain label (prompted, or random if left blank)").option("-d, --domain <domain>", "domain to create the subdomain under (prompted from a list if unset)").option("--name <name>", "alias of --subdomain").option("--zone <domain>", "alias of --domain").option("--hostname <fqdn>", "full hostname override (instead of --subdomain + --domain)").option("--detach", "run the connector in the background").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("--proto <proto>", "local service protocol: http | https", "http").action((port, opts) => runUp(port, opts));
 }
 
 // src/commands/ls.ts
 function registerLs(program) {
-  program.command("ls").description("List tunnel subdomains (managed by default; --all scans the whole account)").option("--all", "scan every zone in the account (slower; shows unmanaged tunnels too)").action(async (opts) => {
+  program.command("ls").alias("ps").description("List tunnel subdomains (managed by default; --all scans the whole account)").option("--all", "scan every zone in the account (slower; shows unmanaged tunnels too)").action(async (opts) => {
     await ensureAuth();
     const cf = resolveCf();
     const rows = await listAll(cf, { all: opts.all });
@@ -905,102 +927,34 @@ function registerLs(program) {
       return;
     }
     printTable(
-      ["SUBDOMAIN", "ZONE", "TARGET", "STATE"],
-      rows.map((r) => [r.hostname, r.zone, r.port, r.state])
+      ["#", "SUBDOMAIN", "TARGET", "STATE", "PID"],
+      rows.map((r) => [r.num, r.hostname, r.port, r.state, r.pid])
     );
   });
 }
 
-// src/commands/rm.ts
-function registerRm(program) {
-  program.command("rm").argument("<target>", "subdomain name or full hostname to delete").description("Delete a tunnel subdomain (stops connector, removes tunnel + DNS)").option("--force", "allow deleting a resource not created by cloudtunnel").option("--dry-run", "show what would be deleted without deleting").option("--keep-dns", "delete the tunnel but leave the DNS record").action(async (target, opts) => {
-    await ensureAuth();
-    const cf = resolveCf();
-    await removeTunnelSubdomain(cf, target, opts);
-  });
-}
-
-// src/commands/update.ts
-function registerUpdate(program) {
-  program.command("update").argument("<name>", "subdomain name or full hostname to update").description("Change the local port/protocol a subdomain points to (zero-downtime)").option("--port <port>", "new local port").option("--proto <proto>", "new local protocol: http | https").action(async (name, opts) => {
-    if (!opts.port) throw new CliError("--port is required", { hint: "e.g. `cloudtunnel update myapp --port 8080`" });
-    const port = Number(opts.port);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new CliError(`Invalid port: ${opts.port}`);
-    await ensureAuth();
-    const cf = resolveCf();
-    await updateIngress(cf, name, port, opts.proto);
-  });
-}
-
-// src/commands/status.ts
-function registerStatus(program) {
-  program.command("status").argument("<name>", "subdomain name or full hostname").description("Show tunnel health and connector state for a subdomain").action(async (name) => {
-    await ensureAuth();
-    const cf = resolveCf();
-    const { fqdn, entry } = resolveTarget(name);
-    if (!entry?.tunnelId) throw new CliError(`No tracked tunnel for ${fqdn}.`);
-    const connections = await getConnections(cf, entry.tunnelId);
-    const connectorAlive = await isOurConnector(entry);
-    say.info(`Host:      https://${fqdn}`);
-    say.info(`Tunnel:    ${entry.tunnelId} \u2014 ${connections.length} edge connection(s)`);
-    say.info(`Connector: ${connectorAlive ? `running (pid ${entry.pid})` : "stopped"}`);
-    say.info(`Target:    ${entry.proto}://localhost:${entry.port}`);
-  });
-}
-
 // src/commands/down.ts
-async function stopEntry(entry) {
-  const stopped = await stopConnector(entry);
-  await mutateRegistry((reg) => {
-    const e = reg[`${entry.subdomain}.${entry.zone}`];
-    if (e) {
-      e.state = "stopped";
-      delete e.pid;
-    }
-  });
-  return stopped;
-}
 function registerDown(program) {
-  program.command("down").argument("[name]", "subdomain to stop (omit with --all to stop everything)").description("Stop a running connector, leaving the tunnel + DNS intact").option("--all", "stop all running connectors").action(async (name, opts) => {
-    if (opts.all) {
-      const running = listEntries().filter((e) => e.pid);
-      let stopped = 0;
-      for (const entry2 of running) if (await stopEntry(entry2)) stopped++;
-      say.ok(`Stopped ${stopped} connector(s).`);
-      return;
-    }
-    if (!name) throw new CliError("Pass a subdomain name or --all.");
-    const { fqdn, entry } = resolveTarget(name);
-    if (!entry) throw new CliError(`No tracked subdomain for ${fqdn}.`);
-    await stopEntry(entry);
-    say.ok(`Stopped ${fqdn}.`);
-  });
-}
-
-// src/commands/gc.ts
-function registerGc(program) {
-  program.command("gc").description("Prune crash orphans (provisioning/orphaned entries) after confirmation").option("--yes", "skip the confirmation prompt").action(async (opts) => {
+  program.command("down").aliases(["rm", "remove", "delete", "stop"]).argument("[target]", "subdomain name / hostname / id / # to release (omit with --all)").description("Stop and release a subdomain \u2014 removes the tunnel + DNS on Cloudflare").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (target, opts) => {
     await ensureAuth();
     const cf = resolveCf();
-    await reconcile();
-    const orphans = listEntries().filter((e) => e.state === "provisioning" || e.state === "orphaned");
-    if (orphans.length === 0) {
-      say.info("Nothing to clean up.");
-      return;
-    }
-    say.info(`Found ${orphans.length} orphaned entr${orphans.length === 1 ? "y" : "ies"}:`);
-    for (const o of orphans) say.dim(`  ${o.subdomain}.${o.zone} (${o.state})`);
-    if (!opts.yes) {
-      say.warn("Re-run with --yes to delete these tunnels/records.");
-      return;
-    }
-    for (const o of orphans) {
-      try {
-        await removeTunnelSubdomain(cf, `${o.subdomain}.${o.zone}`, { force: true });
-      } catch {
-        say.warn(`Could not fully clean ${o.subdomain}.${o.zone} \u2014 check the dashboard.`);
+    if (opts.all) {
+      const entries = listEntries();
+      if (entries.length === 0) {
+        say.info("Nothing to release.");
+        return;
+      }
+      for (const e of entries) {
+        try {
+          await removeTunnelSubdomain(cf, `${e.subdomain}.${e.zone}`, { force: opts.force, dryRun: opts.dryRun });
+        } catch (err) {
+          say.warn(`Could not release ${e.subdomain}.${e.zone}: ${err.message}`);
+        }
       }
+      return;
     }
+    if (!target) throw new CliError("Pass a subdomain (name / id / #) or --all.");
+    await removeTunnelSubdomain(cf, target, { force: opts.force, dryRun: opts.dryRun });
   });
 }
 
@@ -1115,12 +1069,19 @@ async function runProfile(name, opts) {
     const conn = startConnector({
       bin,
       token: result.token,
-      detach: false,
+      detach: !!opts.detach,
       logFile,
-      onExit: () => say.warn(`Connector for ${fqdn} exited \u2014 check \`cloudtunnel status ${result.host.subdomain}\`.`)
+      onExit: opts.detach ? void 0 : () => say.warn(`Connector for ${fqdn} exited.`)
     });
     await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile });
-    started.push({ fqdn, subdomain: result.host.subdomain, tunnelId: result.tunnelId, target: `${svc.proto}://localhost:${svc.port}` });
+    started.push({ fqdn, subdomain: result.host.subdomain, tunnelId: result.tunnelId, target: `${svc.proto}://localhost:${svc.port}`, pid: conn.pid });
+  }
+  if (opts.detach) {
+    spin.stop(`${started.length} service(s) started in the background`);
+    const lines2 = started.map((s) => `${formatRoute(s.fqdn, s.target)}  ${dim(`pid ${s.pid}`)}`);
+    clack3.note(lines2.join("\n"), `profile "${name}" \u2014 running in background`);
+    if (process.stdout.isTTY) clack3.outro("Stop them with: cloudtunnel down --all");
+    return;
   }
   spin.message("Connecting to the Cloudflare edge\u2026");
   const healths = await Promise.all(started.map((s) => waitHealthy(cf, s.tunnelId, { timeoutMs: 3e4 })));
@@ -1128,17 +1089,19 @@ async function runProfile(name, opts) {
   spin.stop(`${started.length} service(s) started`);
   const lines = started.map((s, i) => `${formatRoute(s.fqdn, s.target)}${healths[i] === "healthy" ? "" : dim(`  (${healths[i]})`)}`);
   clack3.note(lines.join("\n"), `profile "${name}" \u2014 ${live}/${started.length} live`);
-  say.dim("Ctrl-C stops all connectors (subdomains are kept).");
+  say.dim("Ctrl-C stops and releases all of them.");
   let tornDown = false;
   const teardownAll = async (code) => {
     if (tornDown) return;
     tornDown = true;
     try {
       for (const s of started) {
-        const entry = getEntry(s.fqdn);
-        if (entry) await stopConnector(entry);
+        try {
+          await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
+        } catch {
+        }
       }
-      if (process.stdout.isTTY) clack3.outro(`Stopped ${started.length} connector(s) \xB7 subdomains kept`);
+      if (process.stdout.isTTY) clack3.outro(`Stopped \xB7 released ${started.length} subdomain(s)`);
     } catch (err) {
       reportError(err);
     } finally {
@@ -1150,7 +1113,7 @@ async function runProfile(name, opts) {
   }
 }
 function registerRun(program) {
-  program.command("run").argument("<profile>", "name of a saved profile (see `cloudtunnel profiles`)").description("Start every service in a saved profile at once").option("-f, --force", "take over subdomains already occupied by another record").option("-d, --domain <domain>", "override the profile's domain for this run").action((name, opts) => runProfile(name, opts));
+  program.command("run").argument("<profile>", "name of a saved profile (see `cloudtunnel profiles`)").description("Start every service in a saved profile at once").option("-f, --force", "take over subdomains already occupied by another record").option("-d, --domain <domain>", "override the profile's domain for this run").option("--detach", "run all connectors in the background (stop with `cloudtunnel down --all`)").action((name, opts) => runProfile(name, opts));
 }
 
 // src/commands/profiles.ts
@@ -1177,6 +1140,50 @@ function registerProfiles(program) {
   });
 }
 
+// src/commands/logs.ts
+import { closeSync, existsSync as existsSync3, openSync as openSync2, readFileSync as readFileSync5, readSync, statSync, watch } from "fs";
+function printTail(file, n) {
+  const lines = readFileSync5(file, "utf8").split("\n");
+  const tail = lines.slice(-n).join("\n");
+  process.stdout.write(tail.endsWith("\n") ? tail : `${tail}
+`);
+  return statSync(file).size;
+}
+function follow(file, fromPos) {
+  let pos = fromPos;
+  say.dim("\u2014 following (Ctrl-C to stop) \u2014");
+  const watcher = watch(file, () => {
+    const size = statSync(file).size;
+    if (size < pos) {
+      pos = 0;
+      return;
+    }
+    if (size > pos) {
+      const fd = openSync2(file, "r");
+      const buf = Buffer.alloc(size - pos);
+      readSync(fd, buf, 0, size - pos, pos);
+      closeSync(fd);
+      process.stdout.write(buf.toString("utf8"));
+      pos = size;
+    }
+  });
+  process.on("SIGINT", () => {
+    watcher.close();
+    process.exit(0);
+  });
+}
+function registerLogs(program) {
+  program.command("logs").argument("<target>", "subdomain name / hostname / id / #").description("Show the connector log for a subdomain (use -f to follow)").option("-f, --follow", "keep printing new log lines (like tail -f)").option("-n, --lines <n>", "number of lines to show", "50").action((name, opts) => {
+    const { fqdn, entry } = resolveTarget(name);
+    if (!entry?.logFile || !existsSync3(entry.logFile)) {
+      throw new CliError(`No logs for ${fqdn} yet.`, { hint: "start it with `cloudtunnel up` or `cloudtunnel run`" });
+    }
+    const n = Math.max(1, Number(opts.lines) || 50);
+    const pos = printTail(entry.logFile, n);
+    if (opts.follow) follow(entry.logFile, pos);
+  });
+}
+
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
@@ -1184,11 +1191,13 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "login",
   "up",
   "ls",
-  "rm",
-  "update",
-  "status",
+  "ps",
   "down",
-  "gc",
+  "rm",
+  "remove",
+  "delete",
+  "stop",
+  "logs",
   "zones",
   "save",
   "run",
@@ -1205,7 +1214,7 @@ function applyBarePortAlias(argv) {
 }
 function buildProgram() {
   const program = new Command();
-  program.name("cloudtunnel").description("Manage Cloudflare Tunnels and subdomains account-wide, nport-style.").version(pkg.version, "-v, --version").showHelpAfterError();
+  program.name("cloudtunnel").description("Manage Cloudflare Tunnels and subdomains account-wide, from your terminal.").version(pkg.version, "-v, --version").showHelpAfterError();
   program.addHelpText(
     "before",
     [
@@ -1219,15 +1228,12 @@ function buildProgram() {
     registerLogin,
     registerUp,
     registerLs,
-    registerRm,
-    registerUpdate,
-    registerStatus,
     registerDown,
-    registerGc,
     registerZones,
     registerSave,
     registerRun,
-    registerProfiles
+    registerProfiles,
+    registerLogs
   ]) {
     register(program);
   }