@iamken/cloudtunnel 0.8.0 → 0.10.0

package/dist/index.js

@@ -2,35 +2,42 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-CWJA4L7J.js";
+} from "./chunk-JBKEAGXV.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   isManagedDns
-} from "./chunk-NZKGIDIW.js";
+} from "./chunk-ZTOVYAS4.js";
 import {
   CliError,
+  DEFAULT_API_BASE,
+  RELAY_SECRET_HEADER,
   __export,
   binDir,
   cfPaginate,
   cfRequest,
   configFile,
   ensureDirs,
+  ensureRelaySecret,
+  getApiBase,
   getCredentials,
+  getRelaySecret,
+  isHttpUrl,
   loadConfig,
   logDir,
   profilesFile,
   registryFile,
   reportError,
   resolveCf,
-  saveConfig
-} from "./chunk-RWR6VXNB.js";
+  saveConfig,
+  scanCacheFile
+} from "./chunk-HVBIMS4W.js";
 
 // src/index.ts
 import { Command } from "commander";
 import { createRequire } from "module";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 
 // src/config/legacy-migrate.ts
 import { existsSync as existsSync3, readFileSync, renameSync, writeFileSync as writeFileSync4 } from "fs";
@@ -164,6 +171,17 @@ function formatTunnelSpec(s) {
 var fqdnFor = (subdomain, zone) => subdomain === "@" ? zone : `${subdomain}.${zone}`;
 var serviceSlug = (fqdn) => fqdn.replace(/[^a-zA-Z0-9]+/g, "-");
 function buildUpArgs(p) {
+  if (p.command === "relay") {
+    return [
+      "relay",
+      p.subdomain,
+      "-d",
+      p.zone,
+      ...p.proto === "https" ? ["--proto", "https"] : [],
+      "-f",
+      "-y"
+    ];
+  }
   const spec = formatTunnelSpec({ subdomain: p.subdomain, port: p.port, host: p.host });
   return [
     "up",
@@ -571,13 +589,17 @@ function openBrowser(url) {
 }
 
 // src/config/resolve-identity.ts
-var API_BASE = "https://api.cloudflare.com/client/v4";
 async function cfGet(path, token) {
+  const base = getApiBase();
+  const secret = getRelaySecret();
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json"
+  };
+  if (secret && base !== DEFAULT_API_BASE) headers[RELAY_SECRET_HEADER] = secret;
   let res;
   try {
-    res = await fetch(`${API_BASE}${path}`, {
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
-    });
+    res = await fetch(`${base}${path}`, { headers });
   } catch {
     throw new CliError("Could not reach the Cloudflare API (network error).");
   }
@@ -637,6 +659,22 @@ async function acquireToken(opts) {
   return { token, fromEnv: false };
 }
 async function runLoginFlow(opts = {}) {
+  if (opts.apiBase && !isHttpUrl(opts.apiBase)) {
+    throw new CliError(`Invalid --api-base "${opts.apiBase}".`, {
+      hint: "must be an http(s) URL, e.g. https://cfapi.example.com/client/v4"
+    });
+  }
+  if (opts.tokenStdin && opts.relaySecretStdin) {
+    throw new CliError("Can't read both the token and the relay secret from stdin.", {
+      hint: "run login twice, or set one via env (CLOUDFLARE_API_TOKEN / CLOUDTUNNEL_RELAY_SECRET)"
+    });
+  }
+  if (opts.apiBase) process.env.CLOUDTUNNEL_API_BASE = opts.apiBase;
+  let relaySecretInput;
+  if (opts.relaySecretStdin) {
+    relaySecretInput = await readStdin();
+    if (relaySecretInput) process.env.CLOUDTUNNEL_RELAY_SECRET = relaySecretInput;
+  }
   if (process.stdout.isTTY) clack.intro("cloudtunnel \xB7 connect to Cloudflare");
   const { token, fromEnv } = await acquireToken(opts);
   const spin = clack.spinner();
@@ -659,12 +697,29 @@ async function runLoginFlow(opts = {}) {
       defaultZone = (await selectOne("Select a default domain", zones, (z) => z.name)).name;
     }
   }
-  saveConfig({ apiToken: fromEnv ? void 0 : token, accountId: account.id, defaultZone });
+  saveConfig(buildMergedConfig(loadConfig(), {
+    token,
+    fromEnv,
+    accountId: account.id,
+    defaultZone,
+    apiBase: opts.apiBase,
+    relaySecret: relaySecretInput
+  }));
   const summary = `Logged in as ${account.name}${defaultZone ? ` \xB7 default domain ${defaultZone}` : ""}`;
   if (process.stdout.isTTY) clack.outro(summary);
   else say.ok(summary);
   if (!defaultZone) say.dim("No default domain set \u2014 pass -d <domain> on `up`, or re-run `login --zone <domain>`.");
 }
+function buildMergedConfig(prev, args) {
+  return {
+    ...prev,
+    apiToken: args.fromEnv ? void 0 : args.token,
+    accountId: args.accountId,
+    defaultZone: args.defaultZone ?? prev.defaultZone,
+    apiBase: args.apiBase ?? prev.apiBase,
+    relaySecret: args.relaySecret ?? prev.relaySecret
+  };
+}
 function showStatus() {
   const config = loadConfig();
   const token = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;
@@ -676,10 +731,14 @@ function showStatus() {
   say.info(`Token:   ${redactToken(token)} (${source})`);
   say.info(`Account: ${config.accountId ?? "(from env / unresolved)"}`);
   say.info(`Domain:  ${config.defaultZone ?? "(none)"}`);
+  const baseSrc = process.env.CLOUDTUNNEL_API_BASE ? "env" : config.apiBase ? "config" : "default";
+  say.info(`Base:    ${getApiBase()} (${baseSrc})`);
+  const secretSrc = process.env.CLOUDTUNNEL_RELAY_SECRET ? "env" : config.relaySecret ? "config" : void 0;
+  say.info(`Relay secret: ${secretSrc ? `set (${secretSrc})` : "(none)"}`);
   say.dim(`Config:  ${configFile}`);
 }
 function registerLogin(program) {
-  program.command("login").description("Authenticate with Cloudflare (paste a token once; account + domain auto-resolved)").option("--token-stdin", "read the API token from stdin (scriptable, avoids shell history)").option("--token <token>", "[discouraged] token as an argument (leaks into shell history)").option("--account <id>", "Cloudflare account id (auto-resolved when you have one account)").option("--zone <domain>", "default domain for new tunnels (auto-resolved when you have one)").option("--status", "show current identity (redacted) and exit").action(async (opts) => {
+  program.command("login").description("Authenticate with Cloudflare (paste a token once; account + domain auto-resolved)").option("--token-stdin", "read the API token from stdin (scriptable, avoids shell history)").option("--token <token>", "[discouraged] token as an argument (leaks into shell history)").option("--account <id>", "Cloudflare account id (auto-resolved when you have one account)").option("--zone <domain>", "default domain for new tunnels (auto-resolved when you have one)").option("--api-base <url>", "route the CF API through a relay (when api.cloudflare.com is blocked)").option("--relay-secret-stdin", "read the relay shared secret from stdin (pairs with --api-base)").option("--status", "show current identity (redacted) and exit").action(async (opts) => {
     if (opts.status) return showStatus();
     await runLoginFlow(opts);
   });
@@ -1197,12 +1256,32 @@ async function rollback(cf, zoneId, tunnelId, dnsRecordId, hostname) {
       await deleteTunnel(cf, tunnelId);
     } catch {
       clean = false;
-      say.warn(`Left tunnel ${tunnelId} behind \u2014 remove it with \`cloudtunnel down ${hostname}\`.`);
+      say.warn(`Left tunnel ${tunnelId} behind \u2014 remove it with \`cloudtunnel delete ${tunnelId} -f\`.`);
     }
   }
   return clean;
 }
 
+// src/core/unmanaged-scan-cache.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync7 } from "fs";
+function saveUnmanagedScan(rows) {
+  try {
+    ensureDirs();
+    const cache = {};
+    for (const [num, row] of rows) cache[String(num)] = row;
+    writeFileSync7(scanCacheFile, JSON.stringify(cache, null, 2), { mode: 384 });
+  } catch {
+  }
+}
+function lookupUnmanagedByIndex(num) {
+  try {
+    const cache = JSON.parse(readFileSync4(scanCacheFile, "utf8"));
+    return cache[String(num)];
+  } catch {
+    return void 0;
+  }
+}
+
 // src/core/orchestrator-manage.ts
 var tunnelIdFromCname2 = (content) => content.replace(/\.cfargotunnel\.com\.?$/, "");
 var isNotFound = (err) => err instanceof CliError && err.status === 404;
@@ -1271,6 +1350,34 @@ async function removeTunnelSubdomain(cf, target, opts = {}) {
   await removeEntry(fqdn);
   if (!opts.quiet) say.ok(`Released ${fqdn}`);
 }
+var TUNNEL_ID_PREFIX_RE = /^[0-9a-f][0-9a-f-]{5,}$/;
+async function resolveRemoteTarget(cf, target) {
+  if (!TUNNEL_ID_PREFIX_RE.test(target)) return null;
+  const matches = (await listTunnels(cf)).filter((t) => t.id.startsWith(target));
+  if (matches.length > 1) {
+    throw new CliError(`"${target}" matches ${matches.length} tunnels on the account.`, { hint: "use a longer id prefix" });
+  }
+  const tunnel = matches[0];
+  if (!tunnel) return null;
+  const { listCargoCnames } = await import("./dns-43EGJW7E.js");
+  const { listZones: listZones3 } = await import("./zones-QZPJFIDD.js");
+  for (const zone of await listZones3(cf.token)) {
+    const rec = (await listCargoCnames(cf.token, zone.id)).find((r) => tunnelIdFromCname2(r.content) === tunnel.id);
+    if (rec) return { tunnel, fqdn: rec.name };
+  }
+  return { tunnel };
+}
+async function removeTunnelById(cf, tunnel, opts = {}) {
+  if (!isManagedTunnel(tunnel) && !opts.force) {
+    throw new CliError(`Tunnel ${tunnel.id} is not managed by cloudtunnel.`, { hint: "pass --force to release it" });
+  }
+  if (opts.dryRun) {
+    say.info(`Would release: tunnel ${tunnel.id} (no DNS record)`);
+    return;
+  }
+  await deleteTunnelWithConnections(cf, tunnel.id);
+  if (!opts.quiet) say.ok(`Released tunnel ${tunnel.id}`);
+}
 async function listAll(cf, opts = {}) {
   const entries = await reconcile();
   const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
@@ -1290,16 +1397,24 @@ async function listAll(cf, opts = {}) {
     };
   });
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-5OXFAQ4D.js");
-    const { listZones: listZones3 } = await import("./zones-QYV3DSEY.js");
+    const { listCargoCnames } = await import("./dns-43EGJW7E.js");
+    const { listZones: listZones3 } = await import("./zones-QZPJFIDD.js");
     const tracked = new Set(entries.map(entryFqdn));
+    const unmanaged = [];
     for (const zone of await listZones3(cf.token)) {
       for (const rec of await listCargoCnames(cf.token, zone.id)) {
-        if (!tracked.has(rec.name)) {
-          rows.push({ num: "-", url: `https://${rec.name}`, target: "-", protocol: "-", state: "unmanaged", service: "-", pid: "-", managed: false });
-        }
+        if (!tracked.has(rec.name)) unmanaged.push(rec);
       }
     }
+    unmanaged.sort((a, b) => a.name.localeCompare(b.name));
+    let next = Math.max(0, ...entries.map((e) => e.index ?? 0)) + 1;
+    const scan = /* @__PURE__ */ new Map();
+    for (const rec of unmanaged) {
+      scan.set(next, { fqdn: rec.name, tunnelId: tunnelIdFromCname2(rec.content) });
+      rows.push({ num: String(next), url: `https://${rec.name}`, target: "-", protocol: "-", state: "unmanaged", service: "-", pid: "-", managed: false });
+      next++;
+    }
+    saveUnmanagedScan(scan);
   }
   return rows;
 }
@@ -1376,6 +1491,17 @@ async function startTunnels(cf, bin, items, opts = {}) {
   say.dim("Ctrl-C stops and releases them.");
 }
 
+// src/core/resolve-domain.ts
+async function resolveDomain(cf, opts, creds) {
+  if (opts.domain) return opts.domain;
+  const zones = await listZones(cf.token);
+  if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
+  if (zones.length === 1) return zones[0].name;
+  if (process.stdin.isTTY) return (await selectOne("Choose a domain", zones, (z) => z.name)).name;
+  if (creds.defaultZone) return creds.defaultZone;
+  throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
+}
+
 // src/core/transport-protocol.ts
 function parseTransportProtocol(value) {
   if (value === "auto" || value === "http2" || value === "quic") return value;
@@ -1404,15 +1530,6 @@ async function promptPort() {
   );
   return Number(input);
 }
-async function resolveDomain(cf, opts, creds) {
-  if (opts.domain) return opts.domain;
-  const zones = await listZones(cf.token);
-  if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
-  if (zones.length === 1) return zones[0].name;
-  if (process.stdin.isTTY) return (await selectOne("Choose a domain", zones, (z) => z.name)).name;
-  if (creds.defaultZone) return creds.defaultZone;
-  throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
-}
 async function resolveSpecSubdomain(spec, opts) {
   if (spec.subdomain !== void 0) return spec.subdomain;
   if (opts.yes || !process.stdin.isTTY) return void 0;
@@ -1528,7 +1645,7 @@ async function deleteOne(cf, fqdn, opts) {
   else say.ok(`Removed boot service ${serviceName(fqdn)}`);
 }
 function registerDelete(program) {
-  program.command("delete").argument("[targets...]", "subdomains to remove by # / name / URL (omit with --all)").description("Release tunnel(s) \u2014 deletes the tunnel + DNS, and any systemd boot service").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (targets, opts) => {
+  program.command("delete").argument("[targets...]", "subdomains to remove by # / name / URL / tunnel-id (omit with --all)").description("Release tunnel(s) \u2014 deletes the tunnel + DNS, and any systemd boot service").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (targets, opts) => {
     await ensureAuth();
     const cf = resolveCf();
     if (opts.all) {
@@ -1547,18 +1664,35 @@ function registerDelete(program) {
       }
       return;
     }
-    if (targets.length === 0) throw new CliError("Pass a subdomain (# / name / URL) or --all.");
+    if (targets.length === 0) throw new CliError("Pass a subdomain (# / name / URL / tunnel-id) or --all.");
     for (const target of targets) {
-      const { fqdn } = resolveTarget(target);
+      let fqdn;
+      try {
+        ({ fqdn } = resolveTarget(target));
+      } catch (err) {
+        const scanned = /^\d+$/.test(target) ? lookupUnmanagedByIndex(Number(target)) : void 0;
+        if (scanned) {
+          say.info(`${target} \u2192 ${scanned.fqdn} (unmanaged, numbered by the last \`ls --all\`)`);
+          fqdn = scanned.fqdn;
+        } else {
+          const remote = await resolveRemoteTarget(cf, target);
+          if (!remote) throw err;
+          if (!remote.fqdn) {
+            await removeTunnelById(cf, remote.tunnel, opts);
+            continue;
+          }
+          fqdn = remote.fqdn;
+        }
+      }
       await deleteOne(cf, fqdn, opts);
     }
   });
 }
 
 // src/commands/logs.ts
-import { closeSync, existsSync as existsSync6, openSync as openSync2, readFileSync as readFileSync4, readSync, statSync, watch } from "fs";
+import { closeSync, existsSync as existsSync6, openSync as openSync2, readFileSync as readFileSync5, readSync, statSync, watch } from "fs";
 function printTail(file, n) {
-  const lines = readFileSync4(file, "utf8").split("\n");
+  const lines = readFileSync5(file, "utf8").split("\n");
   const tail = lines.slice(-n).join("\n");
   process.stdout.write(tail.endsWith("\n") ? tail : `${tail}
 `);
@@ -1599,6 +1733,173 @@ function registerLogs(program) {
   });
 }
 
+// src/commands/relay.ts
+import { openSync as openSync3 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { join as join8 } from "path";
+import pc2 from "picocolors";
+
+// src/core/api-proxy-server.ts
+import http from "http";
+var DEFAULT_UPSTREAM = "https://api.cloudflare.com";
+var SECRET_HEADER_LC = RELAY_SECRET_HEADER.toLowerCase();
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "host",
+  "content-length"
+]);
+function send(res, code, body) {
+  res.writeHead(code, { "content-type": "application/json" });
+  res.end(body === void 0 ? "" : JSON.stringify(body));
+}
+function startProxy(opts) {
+  const upstream = opts.upstream ?? DEFAULT_UPSTREAM;
+  const upstreamOrigin = new URL(upstream).origin;
+  const server = http.createServer((req, res) => {
+    handle(req, res).catch(() => {
+      if (!res.headersSent) send(res, 500, { error: "relay internal error" });
+      else res.end();
+    });
+  });
+  async function handle(req, res) {
+    if (req.method === "CONNECT" || !req.url || !req.url.startsWith("/")) {
+      return send(res, 400, { error: "origin-form request required" });
+    }
+    let target;
+    try {
+      target = new URL(req.url, upstream);
+    } catch {
+      return send(res, 400, { error: "bad request path" });
+    }
+    if (target.origin !== upstreamOrigin) {
+      return send(res, 400, { error: "path escapes upstream" });
+    }
+    if (req.headers[SECRET_HEADER_LC] !== opts.secret) {
+      return send(res, 403, { error: "relay secret missing or invalid" });
+    }
+    const hasBody = req.method !== "GET" && req.method !== "HEAD";
+    let body;
+    if (hasBody) {
+      const chunks = [];
+      for await (const c of req) chunks.push(c);
+      body = chunks.length ? Buffer.concat(chunks) : void 0;
+    }
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (v === void 0) continue;
+      const lk = k.toLowerCase();
+      if (HOP_BY_HOP.has(lk) || lk === SECRET_HEADER_LC) continue;
+      headers[k] = Array.isArray(v) ? v.join(", ") : v;
+    }
+    let up;
+    try {
+      up = await fetch(target.href, { method: req.method, headers, body, redirect: "manual" });
+    } catch {
+      return send(res, 502, { error: "relay upstream unreachable" });
+    }
+    const outHeaders = {
+      "content-type": up.headers.get("content-type") ?? "application/json"
+    };
+    const retryAfter = up.headers.get("retry-after");
+    if (retryAfter) outHeaders["retry-after"] = retryAfter;
+    res.writeHead(up.status, outHeaders);
+    res.end(Buffer.from(await up.arrayBuffer()));
+  }
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve({
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((res) => server.close(() => res()))
+      });
+    });
+  });
+}
+
+// src/commands/relay.ts
+var DEFAULT_SUB = "cfapi";
+function fqdnFor2(sub, domain) {
+  return sub === "@" ? domain : `${sub}.${domain}`;
+}
+function spawnDetachedRelay(sub, domain) {
+  const script = process.argv[1];
+  if (!script) throw new CliError("Cannot resolve the cloudtunnel executable path.");
+  ensureDirs();
+  const logFile = join8(logDir, `relay-${sub === "@" ? "root" : sub}.log`);
+  const fd = openSync3(logFile, "a", 384);
+  const args = [script, "relay", sub, "-d", domain, "-f", "-y"];
+  const child = spawn3(process.execPath, args, { detached: true, stdio: ["ignore", fd, fd] });
+  child.unref();
+}
+function relayReadyLines(fqdn, secret, tty) {
+  const url = `https://${fqdn}`;
+  if (!tty) return [`relay ready at ${url}`];
+  const base = `${url}/client/v4`;
+  return [
+    `URL     ${pc2.green(url)}`,
+    `Secret  ${pc2.bold(secret)}  ${pc2.dim("(store it \u2014 the client needs it, shown once)")}`,
+    "",
+    pc2.bold("On the blocked client:"),
+    `  export CLOUDTUNNEL_API_BASE=${base}`,
+    `  export CLOUDTUNNEL_RELAY_SECRET=${secret}`,
+    `  printf %s "$CF_TOKEN" | cloudtunnel login --token-stdin`,
+    pc2.dim("  (mint the CF token on an unblocked host \u2014 dash.cloudflare.com is blocked too)")
+  ];
+}
+function printRelayReady(fqdn, secret, kind) {
+  const tty = !!process.stdout.isTTY;
+  const lines = relayReadyLines(fqdn, secret, tty);
+  if (tty) note(lines.join("\n"), "relay ready");
+  else say.dim(lines[0]);
+  if (tty && kind === "detach") say.dim("  \u2192 running in background \xB7 stop with: cloudtunnel delete " + fqdn);
+  if (tty && kind === "service") say.dim("  \u2192 boot service installed \xB7 view: cloudtunnel ls \xB7 remove: cloudtunnel delete " + fqdn);
+}
+async function runRelay(sub, opts) {
+  const creds = await ensureAuth();
+  const cf = resolveCf();
+  const domain = await resolveDomain(cf, opts, creds);
+  const fqdn = fqdnFor2(sub, domain);
+  if (opts.service) {
+    assertServiceSupported();
+    const secret2 = ensureRelaySecret();
+    installServiceForSpec({ command: "relay", subdomain: sub, port: 0, zone: domain, proto: "http" });
+    printRelayReady(fqdn, secret2, "service");
+    return;
+  }
+  if (opts.detach) {
+    const secret2 = ensureRelaySecret();
+    spawnDetachedRelay(sub, domain);
+    printRelayReady(fqdn, secret2, "detach");
+    return;
+  }
+  const bin = await ensureCloudflared();
+  const secret = ensureRelaySecret();
+  const proxy = await startProxy({ secret });
+  const item = {
+    port: proxy.port,
+    proto: "http",
+    name: sub,
+    zone: domain,
+    defaultZone: creds.defaultZone,
+    force: opts.force,
+    yes: opts.yes
+  };
+  await startTunnels(cf, bin, [item], {});
+  printRelayReady(fqdn, secret, "foreground");
+}
+function registerRelay(program) {
+  program.command("relay [subdomain]").description("Expose a locked Cloudflare-API reverse proxy via a tunnel (for clients that can't reach api.cloudflare.com directly)").option("-d, --domain <domain>", "domain for the relay subdomain (prompted from a list if unset)").option("--detach", "run the relay in the background").option("--service", "register the relay as a boot service (systemd \xB7 launchd \xB7 Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt before replacing an existing record").action((subdomain, opts) => runRelay(subdomain ?? DEFAULT_SUB, opts));
+}
+
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
@@ -1608,15 +1909,15 @@ function buildProgram() {
   program.addHelpText(
     "before",
     [
-      pc2.bold("Quickstart:"),
-      `  ${pc2.cyan("cloudtunnel login")}       once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
-      `  ${pc2.cyan("cloudtunnel 8080")}        your local :8080 goes live at an HTTPS URL`,
-      `  ${pc2.cyan("cloudtunnel api:8080")}    api.<domain> \u2192 localhost:8080`,
-      `  ${pc2.cyan("cloudtunnel ls")}          list tunnels   ${pc2.dim("\xB7")}   ${pc2.cyan("cloudtunnel delete <#>")}   remove one`,
+      pc3.bold("Quickstart:"),
+      `  ${pc3.cyan("cloudtunnel login")}       once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
+      `  ${pc3.cyan("cloudtunnel 8080")}        your local :8080 goes live at an HTTPS URL`,
+      `  ${pc3.cyan("cloudtunnel api:8080")}    api.<domain> \u2192 localhost:8080`,
+      `  ${pc3.cyan("cloudtunnel ls")}          list tunnels   ${pc3.dim("\xB7")}   ${pc3.cyan("cloudtunnel delete <#>")}   remove one`,
       ""
     ].join("\n")
   );
-  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs]) {
+  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs, registerRelay]) {
     register(program);
   }
   return program;