@iamken/cloudtunnel 0.11.5 → 0.12.0

package/dist/index.js

@@ -2,14 +2,14 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-OT3UCBBF.js";
+} from "./chunk-J6FFC5ZO.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   findDnsRecords,
   isManagedDns
-} from "./chunk-FILVDOPL.js";
+} from "./chunk-XKPTCMTJ.js";
 import {
   CliError,
   DEFAULT_API_BASE,
@@ -18,6 +18,7 @@ import {
   binDir,
   cfPaginate,
   cfRequest,
+  configDir,
   configFile,
   confirm,
   dim,
@@ -42,7 +43,7 @@ import {
   say,
   scanCacheFile,
   selectOne
-} from "./chunk-7XACBYL7.js";
+} from "./chunk-ZIMTYVHN.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -50,7 +51,7 @@ import { createRequire } from "module";
 import pc2 from "picocolors";
 
 // src/config/legacy-migrate.ts
-import { existsSync as existsSync3, readFileSync, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync4 } from "fs";
 
 // src/core/service.ts
 import { join as join5 } from "path";
@@ -134,6 +135,14 @@ function formatTunnelSpec(s) {
 }
 
 // src/core/service-exec.ts
+var SERVICE_SCHEMA = 2;
+var SCHEMA_RE = /cloudtunnel-schema:\s*(\d+)/;
+var schemaMarker = `cloudtunnel-schema: ${SERVICE_SCHEMA}`;
+function schemaOf(text2) {
+  const m = SCHEMA_RE.exec(text2);
+  return m ? Number(m[1]) : 1;
+}
+var unxml = (s) => s.replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 var fqdnFor = (subdomain, zone) => subdomain === "@" ? zone : `${subdomain}.${zone}`;
 var serviceSlug = (fqdn) => fqdn.replace(/[^a-zA-Z0-9]+/g, "-");
 function buildUpArgs(p) {
@@ -192,19 +201,25 @@ __export(service_systemd_exports, {
   install: () => install,
   label: () => label,
   legacyUnitExists: () => legacyUnitExists,
+  listInstalled: () => listInstalled,
+  parseUnit: () => parseUnit,
+  prepareChanges: () => prepareChanges,
   removeLegacyUnit: () => removeLegacyUnit,
   state: () => state,
-  uninstall: () => uninstall
+  uninstall: () => uninstall,
+  uninstallLabel: () => uninstallLabel
 });
 import { execFileSync } from "child_process";
-import { existsSync, writeFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join2 } from "path";
+var UNIT_DIR = "/etc/systemd/system";
 var label = (fqdn) => `cloudtunnel-${serviceSlug(fqdn)}.service`;
-var unitPath = (fqdn) => `/etc/systemd/system/${label(fqdn)}`;
+var unitPath = (fqdn) => `${UNIT_DIR}/${label(fqdn)}`;
 function buildUnit(d) {
   const nodeBin = dirname(d.nodePath);
   return [
+    `# ${schemaMarker}`,
     "[Unit]",
     `Description=cloudtunnel ${d.fqdn} (Cloudflare Tunnel)`,
     "After=network-online.target",
@@ -219,6 +234,8 @@ function buildUnit(d) {
     `ExecStart=${d.nodePath} ${d.scriptPath} ${d.argv.join(" ")}`,
     "Restart=always",
     "RestartSec=5",
+    "KillMode=mixed",
+    "TimeoutStopSec=15",
     "",
     "[Install]",
     "WantedBy=multi-user.target",
@@ -256,13 +273,40 @@ function install(d) {
   privileged(["systemctl", "restart", name]);
 }
 function uninstall(fqdn) {
+  uninstallLabel(label(fqdn));
+}
+function uninstallLabel(name) {
   try {
-    privileged(["systemctl", "disable", "--now", label(fqdn)]);
+    privileged(["systemctl", "disable", "--now", name]);
   } catch {
   }
-  privileged(["rm", "-f", unitPath(fqdn)]);
+  privileged(["rm", "-f", `${UNIT_DIR}/${name}`]);
   privileged(["systemctl", "daemon-reload"]);
 }
+function prepareChanges() {
+  const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  if (!isRoot) execFileSync("sudo", ["-v"], { stdio: "inherit" });
+}
+function parseUnit(name, text2, running) {
+  const exec = /^ExecStart=(.+)$/m.exec(text2)?.[1]?.trim();
+  return { label: name, command: exec ? exec.split(/\s+/) : [], schema: schemaOf(text2), running };
+}
+function listInstalled() {
+  let files = [];
+  try {
+    files = readdirSync(UNIT_DIR).filter((f) => /^cloudtunnel-.+\.service$/.test(f));
+  } catch {
+    return [];
+  }
+  return files.map((f) => {
+    let text2 = "";
+    try {
+      text2 = readFileSync(`${UNIT_DIR}/${f}`, "utf8");
+    } catch {
+    }
+    return parseUnit(f, text2, ["active", "activating", "reloading"].includes(query(["is-active", f])));
+  });
+}
 function state(fqdn) {
   const name = label(fqdn);
   if (query(["is-active", name]) === "active") return "active";
@@ -291,11 +335,15 @@ __export(service_launchd_exports, {
   buildPlist: () => buildPlist,
   install: () => install2,
   label: () => label2,
+  listInstalled: () => listInstalled2,
+  parsePlist: () => parsePlist,
+  prepareChanges: () => prepareChanges2,
   state: () => state2,
-  uninstall: () => uninstall2
+  uninstall: () => uninstall2,
+  uninstallLabel: () => uninstallLabel2
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync2, mkdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname2, join as join3 } from "path";
 import os2 from "os";
 var label2 = (fqdn) => `com.cloudtunnel.${serviceSlug(fqdn)}`;
@@ -310,6 +358,7 @@ function buildPlist(d) {
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
     '<plist version="1.0">',
+    `<!-- ${schemaMarker} -->`,
     "<dict>",
     `  <key>Label</key><string>${xml(label2(d.fqdn))}</string>`,
     "  <key>ProgramArguments</key>",
@@ -318,6 +367,7 @@ function buildPlist(d) {
     "  </array>",
     "  <key>RunAtLoad</key><true/>",
     "  <key>KeepAlive</key><true/>",
+    "  <key>ThrottleInterval</key><integer>10</integer>",
     "  <key>EnvironmentVariables</key>",
     "  <dict>",
     `    <key>PATH</key><string>${xml(path)}</string>`,
@@ -338,6 +388,11 @@ function launchctl(args) {
     return out ? out.toString() : "";
   }
 }
+function waitUnloaded(agentLabel) {
+  for (let i = 0; i < 30 && launchctl(["list", agentLabel]).trim(); i++) {
+    execFileSync2("sleep", ["0.5"]);
+  }
+}
 function assertSupported2() {
 }
 function install2(d) {
@@ -346,13 +401,41 @@ function install2(d) {
   const plist = plistPath(d.fqdn);
   writeFileSync2(plist, buildPlist(d), { mode: 420 });
   launchctl(["unload", "-w", plist]);
+  waitUnloaded(label2(d.fqdn));
   execFileSync2("launchctl", ["load", "-w", plist], { stdio: "inherit" });
 }
 function uninstall2(fqdn) {
-  const plist = plistPath(fqdn);
+  uninstallLabel2(label2(fqdn));
+}
+function uninstallLabel2(agentLabel) {
+  const plist = join3(agentsDir(), `${agentLabel}.plist`);
   launchctl(["unload", "-w", plist]);
   rmSync(plist, { force: true });
 }
+function prepareChanges2() {
+}
+function parsePlist(agentLabel, text2, running) {
+  const block = /<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(text2)?.[1] ?? "";
+  const command = [...block.matchAll(/<string>([\s\S]*?)<\/string>/g)].map((m) => unxml(m[1] ?? ""));
+  return { label: agentLabel, command, schema: schemaOf(text2), running };
+}
+function listInstalled2() {
+  let files = [];
+  try {
+    files = readdirSync2(agentsDir()).filter((f) => /^com\.cloudtunnel\..+\.plist$/.test(f));
+  } catch {
+    return [];
+  }
+  return files.map((f) => {
+    const agentLabel = f.replace(/\.plist$/, "");
+    let text2 = "";
+    try {
+      text2 = readFileSync2(join3(agentsDir(), f), "utf8");
+    } catch {
+    }
+    return parsePlist(agentLabel, text2, /"PID"\s*=/.test(launchctl(["list", agentLabel])));
+  });
+}
 function state2(fqdn) {
   const info = launchctl(["list", label2(fqdn)]);
   if (/"PID"\s*=/.test(info)) return "active";
@@ -366,8 +449,12 @@ __export(service_windows_exports, {
   buildTaskXml: () => buildTaskXml,
   install: () => install3,
   label: () => label3,
+  listInstalled: () => listInstalled3,
+  parseTaskXml: () => parseTaskXml,
+  prepareChanges: () => prepareChanges3,
   state: () => state3,
-  uninstall: () => uninstall3
+  uninstall: () => uninstall3,
+  uninstallLabel: () => uninstallLabel3
 });
 import { execFileSync as execFileSync3 } from "child_process";
 import { writeFileSync as writeFileSync3 } from "fs";
@@ -380,7 +467,7 @@ function buildTaskXml(d) {
   return [
     '<?xml version="1.0" encoding="UTF-16"?>',
     '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
-    `  <RegistrationInfo><Description>cloudtunnel ${xml2(d.fqdn)} (Cloudflare Tunnel)</Description></RegistrationInfo>`,
+    `  <RegistrationInfo><Description>cloudtunnel ${xml2(d.fqdn)} (Cloudflare Tunnel) [${schemaMarker}]</Description></RegistrationInfo>`,
     `  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml2(d.user)}</UserId></LogonTrigger></Triggers>`,
     `  <Principals><Principal id="Author"><UserId>${xml2(d.user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>`,
     "  <Settings>",
@@ -418,7 +505,25 @@ function install3(d) {
   schtasks(["/Run", "/TN", name]);
 }
 function uninstall3(fqdn) {
-  schtasks(["/Delete", "/TN", label3(fqdn), "/F"]);
+  uninstallLabel3(label3(fqdn));
+}
+function uninstallLabel3(name) {
+  schtasks(["/End", "/TN", name]);
+  schtasks(["/Delete", "/TN", name, "/F"]);
+}
+function prepareChanges3() {
+}
+function splitArgs(args) {
+  return [...args.matchAll(/"([^"]*)"|(\S+)/g)].map((m) => m[1] ?? m[2] ?? "");
+}
+function parseTaskXml(name, xmlText, running) {
+  const command = unxml(/<Command>([\s\S]*?)<\/Command>/.exec(xmlText)?.[1] ?? "");
+  const args = unxml(/<Arguments>([\s\S]*?)<\/Arguments>/.exec(xmlText)?.[1] ?? "");
+  return { label: name, command: command ? [command, ...splitArgs(args)] : [], schema: schemaOf(xmlText), running };
+}
+function listInstalled3() {
+  const names = schtasks(["/Query", "/FO", "CSV", "/NH"]).split(/\r?\n/).map((line) => /^"([^"]+)"/.exec(line)?.[1]?.replace(/^\\/, "")).filter((n) => !!n && /^cloudtunnel\\/i.test(n));
+  return [...new Set(names)].map((name) => parseTaskXml(name, schtasks(["/Query", "/TN", name, "/XML"]), true));
 }
 function state3(fqdn) {
   const out = schtasks(["/Query", "/TN", label3(fqdn), "/FO", "LIST"]);
@@ -465,6 +570,15 @@ function installServiceForSpec(params) {
 function uninstallService(fqdn) {
   pick()?.uninstall(fqdn);
 }
+function listInstalledServices() {
+  return pick()?.listInstalled() ?? [];
+}
+function uninstallServiceLabel(label4) {
+  pick()?.uninstallLabel(label4);
+}
+function prepareServiceChanges() {
+  pick()?.prepareChanges();
+}
 function serviceState(fqdn) {
   return pick()?.state(fqdn) ?? "none";
 }
@@ -493,7 +607,7 @@ async function migrateLegacyProfiles() {
   if (!existsSync3(profilesFile) || existsSync3(skipMarker)) return;
   let profiles;
   try {
-    profiles = JSON.parse(readFileSync(profilesFile, "utf8"));
+    profiles = JSON.parse(readFileSync3(profilesFile, "utf8"));
   } catch {
     return;
   }
@@ -847,7 +961,7 @@ async function ensureAuth() {
 // src/connector/binary.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createHash } from "crypto";
-import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
 import { join as join6 } from "path";
 import { gunzipSync } from "zlib";
 var PINNED_VERSION = "2026.7.3";
@@ -878,7 +992,7 @@ function cachedPath() {
 }
 function isMusl() {
   try {
-    return process.platform === "linux" && readFileSync2("/usr/bin/ldd", "utf8").includes("musl");
+    return process.platform === "linux" && readFileSync4("/usr/bin/ldd", "utf8").includes("musl");
   } catch {
     return false;
   }
@@ -1043,16 +1157,17 @@ async function probeEntryState(entry, gone) {
 }
 
 // src/core/up-runner.ts
-import { join as join7 } from "path";
-import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import { join as join9 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync8 } from "fs";
 import * as clack2 from "@clack/prompts";
 
 // src/connector/process.ts
 import { execFileSync as execFileSync7, spawn as spawn2 } from "child_process";
-import { openSync } from "fs";
+import { openSync, renameSync as renameSync3, statSync } from "fs";
+import { createServer } from "net";
 
 // src/connector/registry.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync6 } from "child_process";
 import { readFile } from "fs/promises";
 import os3 from "os";
@@ -1062,7 +1177,7 @@ function entryFqdn(e) {
 }
 function currentBootId() {
   try {
-    return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    return readFileSync5("/proc/sys/kernel/random/boot_id", "utf8").trim();
   } catch {
     if (process.platform === "darwin") {
       try {
@@ -1077,7 +1192,7 @@ function currentBootId() {
 }
 function readRegistry() {
   try {
-    return JSON.parse(readFileSync3(registryFile, "utf8"));
+    return JSON.parse(readFileSync5(registryFile, "utf8"));
   } catch {
     return {};
   }
@@ -1167,14 +1282,17 @@ async function isOurConnector(entry) {
   }
   return true;
 }
+function markConnectorRunning(fqdn, patch) {
+  return patchEntry(fqdn, { bootId: currentBootId(), ...patch, state: "running" });
+}
 async function reconcile() {
   const entries = listEntries();
   for (const entry of entries) {
-    if (entry.state === "running" && !await isOurConnector(entry)) {
+    if (entry.state === "running" && entry.pid && !await isOurConnector(entry)) {
       const fqdn = entryFqdn(entry);
       await mutateRegistry((reg) => {
         const e = reg[fqdn];
-        if (e) {
+        if (e && e.state === "running" && e.pid === entry.pid) {
           e.state = "stopped";
           delete e.pid;
         }
@@ -1186,10 +1304,30 @@ async function reconcile() {
 
 // src/connector/process.ts
 var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+var MAX_LOG_BYTES = 5 * 1024 * 1024;
+function pickFreePort() {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.unref();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      srv.close(() => port ? resolve(port) : reject(new Error("no free port")));
+    });
+  });
+}
+function rotateLog(logFile) {
+  try {
+    if (statSync(logFile).size > MAX_LOG_BYTES) renameSync3(logFile, `${logFile}.1`);
+  } catch {
+  }
+}
 function startConnector(opts) {
-  const args = ["tunnel", "--metrics", "127.0.0.1:0", "run"];
+  const args = ["tunnel", "--metrics", `127.0.0.1:${opts.metricsPort ?? 0}`, "run"];
   if (opts.protocol) args.push("--protocol", opts.protocol);
   const env = { ...process.env, TUNNEL_TOKEN: opts.token };
+  rotateLog(opts.logFile);
   const fd = openSync(opts.logFile, "a", 384);
   const child = spawn2(opts.bin, args, { env, detached: opts.detach, stdio: ["ignore", fd, fd] });
   if (!child.pid) throw new CliError("Failed to start the cloudflared connector.");
@@ -1227,6 +1365,54 @@ async function stopConnector(entry) {
   return true;
 }
 
+// src/connector/hostname-lock.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import { join as join7 } from "path";
+import lockfile2 from "proper-lockfile";
+var locksDir = join7(configDir, "locks");
+var STALE_MS = 15e3;
+var UPDATE_MS = 5e3;
+var lockPath = (fqdn) => join7(locksDir, serviceSlug(fqdn));
+function busyError(fqdn) {
+  return new CliError(`${fqdn} is already being served by another cloudtunnel process.`, {
+    hint: "a boot service may own it \u2014 see `cloudtunnel ls`; release it with `cloudtunnel delete <#>`"
+  });
+}
+async function acquireHostnameLock(fqdn, opts = {}) {
+  mkdirSync2(locksDir, { recursive: true, mode: 448 });
+  const waits = Math.ceil((opts.waitMs ?? 0) / 1e3);
+  try {
+    await takeLock(fqdn, waits);
+  } catch (err) {
+    if (err.code === "ELOCKED") throw busyError(fqdn);
+    throw err;
+  }
+}
+function takeLock(fqdn, waits) {
+  return lockfile2.lock(lockPath(fqdn), {
+    realpath: false,
+    stale: STALE_MS,
+    update: UPDATE_MS,
+    retries: waits > 0 ? { retries: waits, minTimeout: 1e3, maxTimeout: 1e3 } : 0,
+    onCompromised: () => {
+      say.debug(`[lock] ${fqdn} lock was compromised; re-taking it`);
+      takeLock(fqdn, 0).catch((err) => {
+        say.warn(`Lost ${fqdn} to another cloudtunnel process (${err.message}) \u2014 exiting.`);
+        process.exit(1);
+      });
+    }
+  });
+}
+async function assertHostnameFree(fqdn) {
+  let held = false;
+  try {
+    held = await lockfile2.check(lockPath(fqdn), { realpath: false, stale: STALE_MS });
+  } catch {
+    held = false;
+  }
+  if (held) throw busyError(fqdn);
+}
+
 // src/core/orchestrator-create.ts
 import { randomInt as randomInt2 } from "crypto";
 
@@ -1300,6 +1486,10 @@ async function createTunnelSubdomain(cf, opts) {
   const host = resolveHostSpec(opts, opts.defaultZone);
   const zone = await resolveZone(cf.token, host.zone);
   const existingList = await findDnsRecords(cf.token, zone.id, host.hostname);
+  if (opts.reuse) {
+    const reused = await tryReuseTunnel(cf, zone.id, host, opts, existingList);
+    if (reused) return reused;
+  }
   if (existingList.length > 0) {
     const isTunnelRecord = existingList.every((r) => r.content.endsWith(".cfargotunnel.com"));
     if (!isTunnelRecord && !opts.force) {
@@ -1353,6 +1543,25 @@ async function createTunnelSubdomain(cf, opts) {
     throw err;
   }
 }
+async function tryReuseTunnel(cf, zoneId, host, opts, existing) {
+  const prev = getEntry(host.hostname);
+  const tunnelId = prev?.tunnelId;
+  const record = existing[0];
+  if (!prev || !tunnelId || existing.length !== 1 || record?.content !== `${tunnelId}.cfargotunnel.com`) return null;
+  let tunnel;
+  try {
+    tunnel = await getTunnel(cf, tunnelId);
+  } catch (err) {
+    if (err instanceof CliError && err.status === 404) return null;
+    throw err;
+  }
+  if (!isManagedTunnel(tunnel) || tunnel.deleted_at) return null;
+  await putIngress(cf, tunnelId, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto, host: opts.host }));
+  const token = await getTunnelToken(cf, tunnelId);
+  await stopConnector(prev);
+  await recordRunning(host, zoneId, tunnelId, record.id, opts);
+  return { host, tunnelId, token };
+}
 async function recordRunning(host, zoneId, tunnelId, dnsRecordId, opts) {
   await upsertEntry(host.hostname, {
     subdomain: host.subdomain,
@@ -1399,8 +1608,105 @@ async function rollback(cf, zoneId, tunnelId, dnsRecordId, hostname) {
   return clean;
 }
 
+// src/core/service-inventory.ts
+import { existsSync as existsSync6 } from "fs";
+
+// src/core/transport-protocol.ts
+function parseTransportProtocol(value) {
+  if (value === "auto" || value === "http2" || value === "quic") return value;
+  throw new CliError(`Invalid protocol "${value}".`, { hint: "use auto, http2, or quic" });
+}
+
+// src/core/service-inventory.ts
+function flagValue(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+function parseServiceArgv(argv) {
+  const zone = flagValue(argv, "-d");
+  if (!zone) return void 0;
+  const proto = flagValue(argv, "--proto") === "https" ? "https" : "http";
+  try {
+    if (argv[0] === "relay" && argv[1]) {
+      return { command: "relay", subdomain: argv[1], port: 0, zone, proto };
+    }
+    if (argv[0] === "up" && argv[1]) {
+      const spec = parseTunnelSpec(argv[1]);
+      if (spec.subdomain === void 0) return void 0;
+      const protocolFlag = flagValue(argv, "--protocol");
+      return {
+        subdomain: spec.subdomain,
+        port: spec.port,
+        host: spec.host,
+        zone,
+        proto,
+        protocol: protocolFlag ? parseTransportProtocol(protocolFlag) : void 0
+      };
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function classifyDefinition(def, canonicalLabel, exists = existsSync6) {
+  const [nodePath, scriptPath, ...argv] = def.command;
+  const params = parseServiceArgv(argv);
+  if (!params) return void 0;
+  const fqdn = fqdnFor(params.subdomain, params.zone);
+  const canonical = def.label.toLowerCase() === canonicalLabel(fqdn).toLowerCase();
+  let issue;
+  if (!canonical) issue = "duplicate";
+  else if (!nodePath || !scriptPath || !exists(nodePath) || !exists(scriptPath)) issue = "broken";
+  else if (def.schema < SERVICE_SCHEMA || !argv.includes("--keep-alive")) issue = "stale";
+  else if (!def.running) issue = "dead";
+  return { label: def.label, fqdn, params, canonical, issue };
+}
+function inventoryServices() {
+  return listInstalledServices().map((def) => classifyDefinition(def, serviceName)).filter((s) => !!s);
+}
+function planRepair(services, opts = {}) {
+  const byFqdn = /* @__PURE__ */ new Map();
+  for (const s of services) byFqdn.set(s.fqdn, [...byFqdn.get(s.fqdn) ?? [], s]);
+  const actions = [];
+  for (const [fqdn, group] of byFqdn) {
+    const main2 = group.find((s) => s.canonical);
+    const extras = group.filter((s) => !s.canonical);
+    const action = { fqdn, remove: extras.map((s) => s.label) };
+    if (!main2) action.reinstall = { params: extras[0].params, reason: "duplicate" };
+    else if (main2.issue) action.reinstall = { params: main2.params, reason: main2.issue };
+    else if (opts.restartRunning) action.reinstall = { params: main2.params, reason: "outdated" };
+    if (action.reinstall || action.remove.length) actions.push(action);
+  }
+  return actions;
+}
+function runRepair(actions) {
+  const result = { fixed: [], failed: [] };
+  if (actions.length === 0) return result;
+  prepareServiceChanges();
+  for (const a of actions) {
+    try {
+      for (const label4 of a.remove) uninstallServiceLabel(label4);
+      if (a.reinstall) installServiceForSpec(a.reinstall.params);
+      result.fixed.push(a.fqdn);
+    } catch (err) {
+      result.failed.push({ fqdn: a.fqdn, error: err.message });
+    }
+  }
+  return result;
+}
+function serviceIssuesByFqdn() {
+  const map = /* @__PURE__ */ new Map();
+  try {
+    for (const a of planRepair(inventoryServices())) {
+      map.set(a.fqdn, a.reinstall?.reason ?? "duplicate");
+    }
+  } catch {
+  }
+  return map;
+}
+
 // src/core/unmanaged-scan-cache.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
 function saveUnmanagedScan(rows) {
   try {
     ensureDirs();
@@ -1412,7 +1718,7 @@ function saveUnmanagedScan(rows) {
 }
 function lookupUnmanagedByIndex(num) {
   try {
-    const cache = JSON.parse(readFileSync4(scanCacheFile, "utf8"));
+    const cache = JSON.parse(readFileSync6(scanCacheFile, "utf8"));
     return cache[String(num)];
   } catch {
     return void 0;
@@ -1496,8 +1802,8 @@ async function resolveRemoteTarget(cf, target) {
   }
   const tunnel = matches[0];
   if (!tunnel) return null;
-  const { listCargoCnames } = await import("./dns-BNDEFUCM.js");
-  const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
+  const { listCargoCnames } = await import("./dns-VUPKRH46.js");
+  const { listZones: listZones3 } = await import("./zones-CF4XFFZZ.js");
   for (const zone of await listZones3(cf.token)) {
     const rec = (await listCargoCnames(cf.token, zone.id)).find((r) => tunnelIdFromCname2(r.content) === tunnel.id);
     if (rec) return { tunnel, fqdn: rec.name };
@@ -1518,25 +1824,29 @@ async function removeTunnelById(cf, tunnel, opts = {}) {
 async function listAll(cf, opts = {}) {
   const entries = await reconcile();
   const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
+  const issues = serviceIssuesByFqdn();
   const rows = await Promise.all(entries.map(async (e) => {
     const fqdn = entryFqdn(e);
     const gone = e.tunnelId ? !tunnels.has(e.tunnelId) : false;
     const svc = serviceState(fqdn);
     const state4 = await probeEntryState(e, gone);
+    const issue = issues.get(fqdn);
+    const svcLabel = svc === "none" ? "-" : svc;
     return {
       num: e.index ? String(e.index) : "-",
       url: `https://${fqdn}`,
       target: serviceUrl(e.proto, e.host ?? "localhost", e.port),
       protocol: e.protocol ?? "auto",
       state: state4,
-      service: svc === "none" ? "-" : svc,
+      service: issue ? `${svcLabel} (${issue})` : svcLabel,
       pid: e.state === "running" && e.pid ? String(e.pid) : "-",
-      managed: true
+      managed: true,
+      serviceIssue: issue
     };
   }));
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-BNDEFUCM.js");
-    const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
+    const { listCargoCnames } = await import("./dns-VUPKRH46.js");
+    const { listZones: listZones3 } = await import("./zones-CF4XFFZZ.js");
     const tracked = new Set(entries.map(entryFqdn));
     const unmanaged = [];
     for (const zone of await listZones3(cf.token)) {
@@ -1558,19 +1868,27 @@ async function listAll(cf, opts = {}) {
 }
 
 // src/core/watchdog.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
 var activeWatchdogs = /* @__PURE__ */ new Map();
 var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var EXIT_RESTART_GAP_MS = 5e3;
 function resolveMetricsPort(logFile, fallback) {
-  if (existsSync6(logFile)) {
+  if (existsSync7(logFile)) {
     try {
-      const port = extractMetricsPort(readFileSync5(logFile, "utf8"));
+      const port = extractMetricsPort(readFileSync7(logFile, "utf8"));
       if (port) return port;
     } catch {
     }
   }
   return fallback;
 }
+async function freshMetricsPort() {
+  try {
+    return await pickFreePort();
+  } catch {
+    return void 0;
+  }
+}
 async function verifyRemoteTunnel(cf, tunnelId) {
   try {
     await getTunnel(cf, tunnelId);
@@ -1580,25 +1898,39 @@ async function verifyRemoteTunnel(cf, tunnelId) {
     return true;
   }
 }
-async function tier1Restart(ctx, state4) {
-  state4.lastRestartAt = Date.now();
-  state4.tier1Restarts++;
-  say.warn(`[watchdog] Health check failed for ${ctx.fqdn} -> restarting connector (Tier 1)...`);
-  await stopConnector({ pid: ctx.pid, bootId: currentBootId() });
+async function launchConnector(ctx) {
+  const metricsPort = await freshMetricsPort();
   const conn = startConnector({
     bin: ctx.bin,
     token: ctx.token,
     detach: false,
     logFile: ctx.logFile,
     protocol: ctx.protocol,
+    metricsPort,
     onExit: () => {
-      void onConnectorExited(ctx.fqdn);
+      void notifyConnectorExited(ctx.fqdn);
     }
   });
+  if (activeWatchdogs.get(ctx.fqdn)?.ctx !== ctx) {
+    await stopConnector({ pid: conn.pid, bootId: currentBootId() });
+    return;
+  }
   ctx.pid = conn.pid;
   await sleep3(1e3);
-  ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
-  await patchEntry(ctx.fqdn, { pid: conn.pid, metricsPort: ctx.metricsPort, bootId: currentBootId() });
+  ctx.metricsPort = metricsPort ?? resolveMetricsPort(ctx.logFile, ctx.metricsPort);
+  await markConnectorRunning(ctx.fqdn, {
+    pid: conn.pid,
+    metricsPort: ctx.metricsPort,
+    bootId: currentBootId(),
+    tunnelId: ctx.tunnelId
+  });
+}
+async function tier1Restart(ctx, state4) {
+  state4.lastRestartAt = Date.now();
+  state4.tier1Restarts++;
+  say.warn(`[watchdog] Health check failed for ${ctx.fqdn} -> restarting connector (Tier 1)...`);
+  await stopConnector({ pid: ctx.pid, bootId: currentBootId() });
+  await launchConnector(ctx);
   state4.consecutiveFailures = 0;
 }
 async function tier2Reprovision(ctx, state4) {
@@ -1609,36 +1941,46 @@ async function tier2Reprovision(ctx, state4) {
   const result = await createTunnelSubdomain(ctx.cf, { ...ctx.item, force: true, yes: true });
   ctx.tunnelId = result.tunnelId;
   ctx.token = result.token;
-  const conn = startConnector({
-    bin: ctx.bin,
-    token: ctx.token,
-    detach: false,
-    logFile: ctx.logFile,
-    protocol: ctx.protocol,
-    onExit: () => {
-      void onConnectorExited(ctx.fqdn);
-    }
-  });
-  ctx.pid = conn.pid;
-  await sleep3(1e3);
-  ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
-  await patchEntry(ctx.fqdn, { pid: conn.pid, metricsPort: ctx.metricsPort, bootId: currentBootId(), tunnelId: ctx.tunnelId });
+  await launchConnector(ctx);
   state4.consecutiveFailures = 0;
   state4.tier1Restarts = 0;
 }
-async function onConnectorExited(fqdn) {
+async function guardedRestart(fqdn, run2) {
+  const item = activeWatchdogs.get(fqdn);
+  if (!item || item.state.restarting) return;
+  item.state.restarting = true;
+  try {
+    await run2();
+  } catch (err) {
+    say.warn(`[watchdog] Recovery for ${fqdn} failed: ${err.message} \u2014 retrying on the next check`);
+  } finally {
+    item.state.restarting = false;
+  }
+}
+async function notifyConnectorExited(fqdn) {
   const item = activeWatchdogs.get(fqdn);
   if (!item) return;
   const { ctx, state: state4 } = item;
-  if (Date.now() - state4.lastRestartAt < 5e3) return;
-  await tier1Restart(ctx, state4);
+  if (state4.restarting || Date.now() - state4.lastRestartAt < EXIT_RESTART_GAP_MS) return;
+  const run2 = state4.tier1Restarts >= 3 ? tier2Reprovision : tier1Restart;
+  await guardedRestart(fqdn, () => run2(ctx, state4));
 }
 function startTunnelWatchdog(ctx, opts = {}) {
   stopTunnelWatchdog(ctx.fqdn);
   const intervalMs = opts.intervalMs ?? 15e3;
   const cooldownMs = opts.cooldownMs ?? 5e3;
-  const state4 = { consecutiveFailures: 0, tier1Restarts: 0, tier2Restarts: 0, lastRestartAt: 0 };
+  const state4 = { consecutiveFailures: 0, tier1Restarts: 0, tier2Restarts: 0, lastRestartAt: 0, restarting: false };
+  let checking = false;
   const check = async () => {
+    if (state4.restarting || checking) return;
+    checking = true;
+    try {
+      await runCheck();
+    } finally {
+      checking = false;
+    }
+  };
+  const runCheck = async () => {
     if (!ctx.metricsPort) ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
     let healthy = false;
     if (ctx.metricsPort) {
@@ -1647,22 +1989,19 @@ function startTunnelWatchdog(ctx, opts = {}) {
     }
     if (healthy) {
       state4.consecutiveFailures = 0;
+      state4.tier1Restarts = 0;
       return;
     }
     state4.consecutiveFailures++;
     if (state4.consecutiveFailures >= 3 && Date.now() - state4.lastRestartAt >= cooldownMs) {
       const remoteExists = await verifyRemoteTunnel(ctx.cf, ctx.tunnelId);
-      if (!remoteExists || state4.tier1Restarts >= 3) {
-        await tier2Reprovision(ctx, state4);
-      } else {
-        await tier1Restart(ctx, state4);
-      }
+      const run2 = !remoteExists || state4.tier1Restarts >= 3 ? tier2Reprovision : tier1Restart;
+      await guardedRestart(ctx.fqdn, () => run2(ctx, state4));
     }
   };
   const timer = setInterval(() => {
-    void check();
+    check().catch((err) => say.debug(`[watchdog] check failed: ${err.message}`));
   }, intervalMs);
-  if (typeof timer.unref === "function") timer.unref();
   activeWatchdogs.set(ctx.fqdn, { timer, ctx, state: state4 });
 }
 function stopTunnelWatchdog(fqdn) {
@@ -1676,26 +2015,55 @@ function stopAllWatchdogs() {
   for (const [fqdn] of activeWatchdogs) stopTunnelWatchdog(fqdn);
 }
 
+// src/core/installed-version.ts
+import { readFileSync as readFileSync8, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname3, join as join8 } from "path";
+function readInstalledVersion() {
+  try {
+    const script = realpathSync2(process.argv[1] ?? "");
+    const pkg2 = JSON.parse(readFileSync8(join8(dirname3(script), "..", "package.json"), "utf8"));
+    return typeof pkg2.version === "string" ? pkg2.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/core/up-runner.ts
 var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+var UPGRADE_RESTART_EXIT_CODE = 75;
+var VERSION_CHECK_INTERVAL_MS = 6e4;
+var LOCK_WAIT_MS = 3e4;
+var MAX_CREATE_BACKOFF_MS = 6e4;
 function logFileFor(fqdn) {
-  return join7(logDir, `${serviceSlug(fqdn)}.log`);
+  return join9(logDir, `${serviceSlug(fqdn)}.log`);
+}
+function knownFqdn(item) {
+  if (item.hostname) return item.hostname;
+  return item.name !== void 0 && item.zone ? fqdnFor(item.name, item.zone) : void 0;
 }
 async function createWithBootRetry(cf, item, keepAlive) {
-  const deadline = Date.now() + (keepAlive ? 3e4 : 0);
+  if (!keepAlive) return createTunnelSubdomain(cf, item);
   for (let attempt = 0; ; attempt++) {
     try {
-      return await createTunnelSubdomain(cf, item);
+      return await createTunnelSubdomain(cf, { ...item, reuse: true });
     } catch (err) {
-      if (!keepAlive || Date.now() >= deadline) throw err;
-      say.debug(`[boot-retry] Waiting for network to create ${item.name ?? "tunnel"}...`);
-      await sleep4(Math.min(2 ** attempt * 1e3, 5e3));
+      const wait = Math.min(2 ** attempt * 1e3, MAX_CREATE_BACKOFF_MS);
+      say.warn(`Could not create ${item.name ?? "tunnel"} (${err.message}) \u2014 retrying in ${wait / 1e3}s`);
+      await sleep4(wait);
     }
   }
 }
+async function freshMetricsPort2() {
+  try {
+    return await pickFreePort();
+  } catch {
+    return void 0;
+  }
+}
 async function startTunnels(cf, bin, items, opts = {}) {
   const started = [];
   let tornDown = false;
+  const supervised = !!opts.keepAlive && !opts.detach;
   const teardownAll = async (code) => {
     if (tornDown) return;
     tornDown = true;
@@ -1703,7 +2071,8 @@ async function startTunnels(cf, bin, items, opts = {}) {
     try {
       for (const s of started) {
         if (opts.keepAlive) {
-          await stopConnector({ pid: s.pid, bootId: currentBootId() });
+          const current = getEntry(s.fqdn);
+          await stopConnector(current?.pid ? current : { pid: s.pid, bootId: currentBootId() });
         } else {
           try {
             await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
@@ -1718,6 +2087,12 @@ async function startTunnels(cf, bin, items, opts = {}) {
       process.exit(code);
     }
   };
+  for (const item of items) {
+    const fqdn = knownFqdn(item);
+    if (!fqdn) continue;
+    if (opts.detach) await assertHostnameFree(fqdn);
+    else await acquireHostnameLock(fqdn, { waitMs: opts.keepAlive ? LOCK_WAIT_MS : 0 });
+  }
   const spin = clack2.spinner();
   spin.start(items.length > 1 ? "Creating tunnels\u2026" : "Creating tunnel\u2026");
   for (const item of items) {
@@ -1725,28 +2100,35 @@ async function startTunnels(cf, bin, items, opts = {}) {
     const result = await createWithBootRetry(cf, item, opts.keepAlive);
     const fqdn = result.host.hostname;
     const logFile = logFileFor(fqdn);
+    const knownPort = await freshMetricsPort2();
     const conn = startConnector({
       bin,
       token: result.token,
       detach: !!opts.detach,
       logFile,
       protocol: opts.protocol,
+      metricsPort: knownPort,
       onExit: opts.detach ? void 0 : (code) => {
-        if (!tornDown && !opts.keepAlive) {
-          say.warn(`Connector for ${fqdn} exited.`);
-          void teardownAll(code ?? 1);
+        if (tornDown) return;
+        if (opts.keepAlive) {
+          void notifyConnectorExited(fqdn);
+          return;
         }
+        say.warn(`Connector for ${fqdn} exited.`);
+        void teardownAll(code ?? 1);
       }
     });
-    await sleep4(600);
-    let metricsPort;
-    if (existsSync7(logFile)) {
-      try {
-        metricsPort = extractMetricsPort(readFileSync6(logFile, "utf8"));
-      } catch {
+    let metricsPort = knownPort;
+    if (!metricsPort) {
+      await sleep4(600);
+      if (existsSync8(logFile)) {
+        try {
+          metricsPort = extractMetricsPort(readFileSync9(logFile, "utf8"));
+        } catch {
+        }
       }
     }
-    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile, metricsPort, protocol: opts.protocol });
+    await markConnectorRunning(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile, metricsPort, protocol: opts.protocol });
     started.push({
       fqdn,
       subdomain: result.host.subdomain,
@@ -1754,7 +2136,7 @@ async function startTunnels(cf, bin, items, opts = {}) {
       target: serviceUrl(item.proto, item.host ?? "localhost", item.port),
       pid: conn.pid
     });
-    if (!opts.detach) {
+    if (supervised) {
       startTunnelWatchdog({
         cf,
         bin,
@@ -1779,6 +2161,7 @@ async function startTunnels(cf, bin, items, opts = {}) {
   for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
     process.on(sig, () => void teardownAll(0));
   }
+  if (supervised) watchForUpgrade(() => void teardownAll(UPGRADE_RESTART_EXIT_CODE));
   spin.message("Connecting to the Cloudflare edge\u2026");
   const healths = await Promise.all(started.map((s) => waitHealthy(cf, s.tunnelId, { timeoutMs: 3e4 })));
   const live = healths.filter((h) => h === "healthy").length;
@@ -1787,6 +2170,20 @@ async function startTunnels(cf, bin, items, opts = {}) {
   clack2.note(lines.join("\n"), `${live}/${started.length} live`);
   say.dim(opts.keepAlive ? "Service running with auto-heal watchdog." : "Ctrl-C stops and releases them.");
 }
+function watchForUpgrade(restart) {
+  if (process.platform === "win32") return;
+  const startedWith = readInstalledVersion();
+  if (!startedWith) return;
+  const timer = setInterval(() => {
+    const now = readInstalledVersion();
+    if (now && now !== startedWith) {
+      clearInterval(timer);
+      say.warn(`cloudtunnel ${startedWith} \u2192 ${now} installed \u2014 restarting onto the new version\u2026`);
+      restart();
+    }
+  }, VERSION_CHECK_INTERVAL_MS);
+  timer.unref();
+}
 
 // src/core/resolve-domain.ts
 async function resolveDomain(cf, opts, creds) {
@@ -1799,12 +2196,6 @@ async function resolveDomain(cf, opts, creds) {
   throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
 }
 
-// src/core/transport-protocol.ts
-function parseTransportProtocol(value) {
-  if (value === "auto" || value === "http2" || value === "quic") return value;
-  throw new CliError(`Invalid protocol "${value}".`, { hint: "use auto, http2, or quic" });
-}
-
 // src/commands/up.ts
 function promptOrExit(value) {
   if (clack3.isCancel(value)) {
@@ -1940,6 +2331,8 @@ function registerLs(program) {
       ["#", "URL", "TARGET", "PROTOCOL", "STATE", "SERVICE", "PID"],
       rows.map((r) => [r.num, r.url, r.target, r.protocol, r.state, r.service, r.pid])
     );
+    const needRepair = rows.filter((r) => r.serviceIssue).length;
+    if (needRepair) say.warn(`${needRepair} boot service(s) need repair \u2192 cloudtunnel service repair`);
   });
 }
 
@@ -1998,19 +2391,19 @@ function registerDelete(program) {
 }
 
 // src/commands/logs.ts
-import { closeSync, existsSync as existsSync8, openSync as openSync2, readFileSync as readFileSync7, readSync, statSync, watch } from "fs";
+import { closeSync, existsSync as existsSync9, openSync as openSync2, readFileSync as readFileSync10, readSync, statSync as statSync2, watch } from "fs";
 function printTail(file, n) {
-  const lines = readFileSync7(file, "utf8").split("\n");
+  const lines = readFileSync10(file, "utf8").split("\n");
   const tail = lines.slice(-n).join("\n");
   process.stdout.write(tail.endsWith("\n") ? tail : `${tail}
 `);
-  return statSync(file).size;
+  return statSync2(file).size;
 }
 function follow(file, fromPos) {
   let pos = fromPos;
   say.dim("\u2014 following (Ctrl-C to stop) \u2014");
   const watcher = watch(file, () => {
-    const size = statSync(file).size;
+    const size = statSync2(file).size;
     if (size < pos) {
       pos = 0;
       return;
@@ -2032,7 +2425,7 @@ function follow(file, fromPos) {
 function registerLogs(program) {
   program.command("logs").argument("<target>", "subdomain name / hostname / id / #").description("Show the connector log for a subdomain (use -f to follow)").option("-f, --follow", "keep printing new log lines (like tail -f)").option("-n, --lines <n>", "number of lines to show", "50").action((name, opts) => {
     const { fqdn, entry } = resolveTarget(name);
-    if (!entry?.logFile || !existsSync8(entry.logFile)) {
+    if (!entry?.logFile || !existsSync9(entry.logFile)) {
       throw new CliError(`No logs for ${fqdn} yet.`, { hint: "start it with `cloudtunnel up` or `cloudtunnel run`" });
     }
     const n = Math.max(1, Number(opts.lines) || 50);
@@ -2044,7 +2437,7 @@ function registerLogs(program) {
 // src/commands/relay.ts
 import { openSync as openSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 import pc from "picocolors";
 
 // src/core/api-proxy-server.ts
@@ -2151,7 +2544,7 @@ function spawnDetachedRelay(sub, domain) {
   const script = process.argv[1];
   if (!script) throw new CliError("Cannot resolve the cloudtunnel executable path.");
   ensureDirs();
-  const logFile = join8(logDir, `relay-${sub === "@" ? "root" : sub}.log`);
+  const logFile = join10(logDir, `relay-${sub === "@" ? "root" : sub}.log`);
   const fd = openSync3(logFile, "a", 384);
   const args = [script, "relay", sub, "-d", domain, "-f", "-y"];
   const child = spawn3(process.execPath, args, { detached: true, stdio: ["ignore", fd, fd] });
@@ -2209,11 +2602,68 @@ async function runRelay(sub, opts) {
     force: opts.force,
     yes: opts.yes
   };
-  await startTunnels(cf, bin, [item], {});
+  await startTunnels(cf, bin, [item], { keepAlive: opts.keepAlive });
   printRelayReady(fqdn, secret, "foreground");
 }
 function registerRelay(program) {
-  program.command("relay [subdomain]").description("Expose a locked Cloudflare-API reverse proxy via a tunnel (for clients that can't reach api.cloudflare.com directly)").option("-d, --domain <domain>", "domain for the relay subdomain (prompted from a list if unset)").option("--detach", "run the relay in the background").option("--service", "register the relay as a boot service (systemd \xB7 launchd \xB7 Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt before replacing an existing record").action((subdomain, opts) => runRelay(subdomain ?? DEFAULT_SUB, opts));
+  program.command("relay [subdomain]").description("Expose a locked Cloudflare-API reverse proxy via a tunnel (for clients that can't reach api.cloudflare.com directly)").option("-d, --domain <domain>", "domain for the relay subdomain (prompted from a list if unset)").option("--detach", "run the relay in the background").option("--service", "register the relay as a boot service (systemd \xB7 launchd \xB7 Task Scheduler)").option("--keep-alive", "supervised mode with auto-heal watchdog (used by the boot service)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt before replacing an existing record").action((subdomain, opts) => runRelay(subdomain ?? DEFAULT_SUB, opts));
+}
+
+// src/commands/service.ts
+function describeAction(a) {
+  const parts = [];
+  if (a.reinstall) parts.push(`reinstall + restart (${a.reinstall.reason})`);
+  if (a.remove.length) parts.push(`remove duplicate ${a.remove.join(", ")}`);
+  return `${a.fqdn}: ${parts.join(" \xB7 ")}`;
+}
+async function repairWithPrompt(actions, opts = {}) {
+  for (const a of actions) say.dim(`  ${describeAction(a)}`);
+  if (opts.dryRun) return false;
+  const needsSudo = process.platform === "linux" ? " (uses sudo)" : "";
+  if (!opts.yes && !await confirm(`Repair ${actions.length} boot service(s) now?${needsSudo}`)) return false;
+  const res = runRepair(actions);
+  for (const fqdn of res.fixed) say.ok(`Repaired ${fqdn}`);
+  for (const f of res.failed) say.warn(`Could not repair ${f.fqdn}: ${f.error}`);
+  if (res.failed.length) {
+    throw new CliError(`${res.failed.length} boot service(s) could not be repaired.`, { hint: "re-run `cloudtunnel service repair`" });
+  }
+  return res.fixed.length > 0;
+}
+function registerService(program) {
+  const service = program.command("service").description("Manage boot services (installed with `up --service`)");
+  service.command("repair").description("Regenerate + restart boot services that are outdated, broken, stopped, or duplicated").option("-y, --yes", "don't ask for confirmation").option("--dry-run", "show what would be repaired without doing it").action(async (opts) => {
+    assertServiceSupported();
+    const services = inventoryServices();
+    const actions = planRepair(services, { restartRunning: process.platform === "win32" });
+    if (actions.length === 0) {
+      say.ok(`All ${services.length} boot service(s) are up to date and running.`);
+      return;
+    }
+    say.info(`${actions.length} boot service(s) need repair:`);
+    await repairWithPrompt(actions, opts);
+  });
+}
+
+// src/core/service-upgrade-check.ts
+var INFO_ARGS = /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version", "help"]);
+function remember(version) {
+  saveConfig({ ...loadConfig(), serviceCheckVersion: version });
+}
+async function maybeRepairServicesAfterUpgrade(version, argv) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return;
+  const rest = argv.slice(2);
+  if (rest[0] === "service" || rest[0] === "delete" || rest.some((a) => INFO_ARGS.has(a))) return;
+  if (loadConfig().serviceCheckVersion === version) return;
+  try {
+    const actions = planRepair(inventoryServices(), { restartRunning: process.platform === "win32" });
+    if (actions.length) {
+      say.warn(`cloudtunnel ${version}: ${actions.length} boot service(s) need repair to stay up:`);
+      await repairWithPrompt(actions);
+    }
+  } catch (err) {
+    say.warn(`Boot-service check failed: ${err.message} \u2014 run \`cloudtunnel service repair\``);
+  }
+  remember(version);
 }
 
 // src/index.ts
@@ -2233,7 +2683,7 @@ function buildProgram() {
       ""
     ].join("\n")
   );
-  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs, registerRelay]) {
+  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs, registerRelay, registerService]) {
     register(program);
   }
   return program;
@@ -2247,6 +2697,7 @@ function shouldMigrate(argv) {
 async function main() {
   configureProxy();
   if (shouldMigrate(process.argv)) await migrateLegacyProfiles();
+  await maybeRepairServicesAfterUpgrade(pkg.version, process.argv);
   const program = buildProgram();
   try {
     await program.parseAsync(process.argv);