@iicp/client 0.7.54 → 0.7.57

package/README.md

@@ -317,6 +317,8 @@ const node = new IicpNode({
 });
 ```
 
+> **Security note**: relay bind authentication is pending ([#510](https://github.com/RobLe3/iicp.network/issues/510)) — only run a relay accept port on networks you trust until the signed-bind mechanism ships.
+
 ### Opt-out / override
 
 ```bash

package/dist/cli.d.ts

@@ -20,6 +20,8 @@ export interface ServeOpts {
     externalIpProbeUrl: string;
     relayWorkerEndpoint: string;
     relayCapable?: boolean;
+    /** #520 rung 5 tri-state: true=forced, false=disabled, undefined=auto. */
+    tunnel?: boolean;
     relayAcceptPort?: number;
     node: string;
     logDir?: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAwCA,OAAO,EAeL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AA+pBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AA8dD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAyCA,OAAO,EAeL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAuaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB9E;AA0uBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5D;AA8dD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlF"}

package/dist/cli.js

@@ -26,6 +26,7 @@ const node_crypto_1 = require("node:crypto");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const SDK_VERSION = require("../package.json").version;
 const net = require("node:net");
+const http = require("node:http");
 const node_child_process_1 = require("node:child_process");
 const readline = require("node:readline/promises");
 const node_process_1 = require("node:process");
@@ -64,6 +65,7 @@ function printHelp() {
         `  query <prompt>             Discover mesh nodes and submit a chat task\n` +
         `  credits                    Show this node's earned / spent / balance credits\n` +
         `  proxy                      Run the local OpenAI/Ollama/Anthropic-compat gateway (loopback; no registration)\n` +
+        `  mcp-gateway                Bridge a local MCP server as an IICP provider node (registers + serves)\n` +
         `  operator rename <name>     Change your public display_name (signed by your operator key)\n` +
         `  operator encrypt           Password-encrypt the operator secret at rest ($IICP_OPERATOR_PASSPHRASE)\n` +
         `  operator decrypt           Remove at-rest encryption of the operator secret\n\n` +
@@ -90,7 +92,9 @@ function printHelp() {
         `  --external-ip-probe-url U  IICP_EXTERNAL_IP_PROBE_URL — fallback IPv4 probe\n` +
         `  --relay-worker-endpoint H  IICP_RELAY_WORKER_ENDPOINT — <host>:<port> of a relay node (R2 last-resort)\n` +
         `  --relay-capable            IICP_RELAY_CAPABLE — advertise as relay server for CGNAT/tier-4 operators\n` +
-        `  --relay-accept-port N      IICP_RELAY_ACCEPT_PORT — TCP port for relay accept server (default 9485)\n` +
+        `  --relay-accept-port N      IICP_RELAY_ACCEPT_PORT — TCP port for relay accept server (default 9485).\n` +
+        `                             Note: relay bind authentication is pending (#510) — only run a relay\n` +
+        `                             accept port on networks you trust until the signed-bind mechanism ships.\n` +
         `  --log-dir DIR              IICP_LOG_DIR — directory for persistent log files (<node_id>.log + events.jsonl)\n` +
         `  --with-proxy               IICP_WITH_PROXY — also run the loopback compat proxy (127.0.0.1:9483) in-process\n\n` +
         `query optional:\n` +
@@ -541,6 +545,29 @@ async function runServe(opts) {
         }
     }
     let publicEndpoint = opts.publicEndpoint || `http://localhost:${opts.port}`;
+    // #520 rung 5 — Quick Tunnel escalation state (see src/tunnel.ts).
+    const tunnelPref = opts.tunnel;
+    let tunnelHandle = null;
+    const openTunnelRung = async (localPort, forced) => {
+        const { INSTALL_HINT, cloudflaredPath, openQuickTunnel } = await import("./tunnel.js");
+        if (!cloudflaredPath()) {
+            // eslint-disable-next-line no-console
+            console.warn(`[iicp-node] ${INSTALL_HINT}`);
+            return null;
+        }
+        try {
+            const t = await openQuickTunnel(localPort);
+            // eslint-disable-next-line no-console
+            console.log(`[iicp-node] NAT rung 5${forced ? " (forced)" : ""}: public https endpoint via ` +
+                `Quick Tunnel — ${t.url} (zero-account; URL rotates on restart)`);
+            return t;
+        }
+        catch (exc) {
+            // eslint-disable-next-line no-console
+            console.warn(`[iicp-node] Quick Tunnel failed to start: ${exc instanceof Error ? exc.message : exc} — continuing without it`);
+            return null;
+        }
+    };
     // ADR-043 §5 / #343 — Tier-0 IPv6 pinhole attempt. Runs unconditionally
     // when the operator's public_endpoint is bracketed-IPv6, even without
     // --auto-detect-nat. Mirrors Python's cli.py path: try AddPinhole on
@@ -596,10 +623,22 @@ async function runServe(opts) {
                     // eslint-disable-next-line no-console
                     console.log(`[iicp-node] auto-elected relay: ${relayHost}:${relayPort}`);
                 }
+                else if (tunnelPref !== false) {
+                    // #520 rung 5: no relay anywhere → Quick Tunnel (zero-account),
+                    // unless disabled via --no-tunnel / IICP_TUNNEL=0.
+                    tunnelHandle = await openTunnelRung(opts.port, false);
+                    if (tunnelHandle)
+                        publicEndpoint = tunnelHandle.url;
+                    if (!tunnelHandle) {
+                        // eslint-disable-next-line no-console
+                        console.warn(`[iicp-node] NAT tier=${natProfile.tier}: no relay-capable peers and no tunnel ` +
+                            `available. Set IICP_RELAY_WORKER_ENDPOINT=<host>:<port> to specify a relay manually.`);
+                    }
+                }
                 else {
                     // eslint-disable-next-line no-console
-                    console.warn(`[iicp-node] NAT tier=${natProfile.tier}: no relay-capable peers in directory. ` +
-                        `Set IICP_RELAY_WORKER_ENDPOINT=<host>:<port> to specify a relay manually.`);
+                    console.warn(`[iicp-node] NAT tier=${natProfile.tier}: no relay-capable peers in directory ` +
+                        `(tunnel escalation disabled). Set IICP_RELAY_WORKER_ENDPOINT to specify a relay.`);
                 }
             }
         }
@@ -609,6 +648,14 @@ async function runServe(opts) {
             console.warn(`[iicp-node] NAT auto-detect failed: ${msg} — continuing with configured endpoint`);
         }
     }
+    // #520 — `--tunnel` forces rung 5 regardless of NAT tier (e.g. an operator
+    // who KNOWS they're unreachable, or wants an https endpoint for browser
+    // consumers without touching the router).
+    if (tunnelPref === true && tunnelHandle === null) {
+        tunnelHandle = await openTunnelRung(opts.port, true);
+        if (tunnelHandle)
+            publicEndpoint = tunnelHandle.url;
+    }
     const backendFlavor = await detectBackendFlavor(opts.backendUrl, opts.backendApiKey, opts.backendType);
     process.stderr.write(`backend detected: ${backendFlavor}\n`);
     // #463/#464 — bind the operator identity: issue a delegation FROM the (key-backed) operator
@@ -820,6 +867,22 @@ async function runServe(opts) {
     (0, node_log_js_1.writeNodeEvent)(nodeId, "serve_start", `port=${opts.port} model=${opts.model} intent=${opts.intent}`, logDir);
     // serve() returns a stop() handle but never resolves on its own; we wait for
     // SIGINT/SIGTERM to terminate.
+    if (tunnelHandle) {
+        // The endpoint was already the tunnel URL at construction; mark the
+        // transport and arm the watchdog (URL rotates per process → re-register).
+        node["_cfg"].transportMethod = "external_tunnel";
+        tunnelHandle.watch((url) => {
+            node["_cfg"].endpoint = url;
+            void node.register().catch((exc) => {
+                // eslint-disable-next-line no-console
+                console.warn(`[iicp-node] tunnel re-register failed: ${exc instanceof Error ? exc.message : exc}`);
+            });
+        }, () => {
+            // eslint-disable-next-line no-console
+            console.error("[iicp-node] Quick Tunnel permanently down — this node is no longer " +
+                "publicly reachable. Restart `iicp-node serve` to recover.");
+        });
+    }
     const stop = node.serve(handler, { host: opts.host, port: opts.port, nodeToken: token });
     await new Promise((resolve) => {
         const shutdown = async (sig) => {
@@ -844,6 +907,7 @@ async function runServe(opts) {
                 console.warn(`[iicp-node] deregister failed: ${deregMsg}`);
                 (0, node_log_js_1.writeNodeEvent)(nodeId, "deregister_fail", `error=${deregMsg}`, logDir);
             }
+            tunnelHandle?.close(); // #520 — tear the Quick Tunnel down with the node
             stop();
             instanceLock.release(); // #405 — free the pidfile on shutdown
             resolve();
@@ -1591,6 +1655,187 @@ async function main(argv = process.argv.slice(2)) {
         throw exc;
     }
 }
+// ── mcp-gateway (#512) ───────────────────────────────────────────────────────
+const _MCP_DANGEROUS = new Set(["bash", "shell", "exec", "run_command", "eval"]);
+function _toolToIntent(name) {
+    const safe = name.toLowerCase().replace(/[^a-z0-9_]/g, "_");
+    return `urn:iicp:intent:mcp:${safe}:v1`;
+}
+async function runMcpGateway(argv) {
+    const helpFlag = argv.includes("--help") || argv.includes("-h");
+    if (helpFlag) {
+        process.stdout.write(`usage: iicp-node mcp-gateway [options]\n\n` +
+            `Bridge a local MCP server into the IICP mesh as a registered provider node.\n\n` +
+            `Options:\n` +
+            `  --mcp-url URL        IICP_MCP_URL — MCP server base URL (default http://localhost:8001)\n` +
+            `  --tools NAMES        IICP_MCP_TOOLS — comma-separated tool names to advertise (required)\n` +
+            `  --node-id ID         IICP_NODE_ID — auto-generated if absent\n` +
+            `  --public-endpoint U  IICP_PUBLIC_ENDPOINT — externally reachable URL of this gateway\n` +
+            `  --directory-url URL  IICP_DIRECTORY_URL (default https://iicp.network/api/v1)\n` +
+            `  --region REGION      IICP_REGION (default local)\n` +
+            `  --port N             IICP_PORT (default 9484)\n` +
+            `  --host HOST          IICP_HOST (default ::)\n`);
+        return 0;
+    }
+    const { values } = safeParseArgs({
+        args: argv,
+        options: {
+            "mcp-url": { type: "string" },
+            tools: { type: "string" },
+            "node-id": { type: "string" },
+            "public-endpoint": { type: "string" },
+            "directory-url": { type: "string" },
+            region: { type: "string" },
+            port: { type: "string" },
+            host: { type: "string" },
+        },
+        allowPositionals: false,
+    });
+    const mcpUrl = (values["mcp-url"] ?? envOr("IICP_MCP_URL") ?? "http://localhost:8001").replace(/\/$/, "");
+    const rawTools = (values["tools"] ?? envOr("IICP_MCP_TOOLS") ?? "")
+        .split(",").map((t) => t.trim()).filter(Boolean);
+    const activeTools = rawTools.filter((t) => !_MCP_DANGEROUS.has(t.toLowerCase()));
+    if (activeTools.length === 0) {
+        process.stderr.write(`ERROR: --tools is required. Provide a comma-separated list of MCP tool names.\n` +
+            `  Example: iicp-node mcp-gateway --tools read_file,list_dir --mcp-url http://localhost:8001\n`);
+        return 2;
+    }
+    const nodeId = values["node-id"] ?? envOr("IICP_NODE_ID") ?? `gateway-mcp-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`;
+    const directoryUrl = (values["directory-url"] ?? envOr("IICP_DIRECTORY_URL") ?? "https://iicp.network/api/v1").replace(/\/$/, "");
+    const region = values["region"] ?? envOr("IICP_REGION") ?? "local";
+    const port = parsePort(values["port"], 9484);
+    const host = values["host"] ?? envOr("IICP_HOST") ?? "::";
+    const publicEndpoint = values["public-endpoint"] ?? envOr("IICP_PUBLIC_ENDPOINT") ?? `http://localhost:${port}`;
+    const intents = activeTools.map(_toolToIntent);
+    let nodeToken = envOr("IICP_NODE_TOKEN") ?? "";
+    async function doRegister() {
+        const payload = { node_id: nodeId, region, endpoint: publicEndpoint, intents, mcp_tools: activeTools, protocol_version: "1.0" };
+        const headers = { "Content-Type": "application/json" };
+        if (nodeToken)
+            headers["Authorization"] = `Bearer ${nodeToken}`;
+        const resp = await fetch(`${directoryUrl}/register`, { method: "POST", headers, body: JSON.stringify(payload), signal: AbortSignal.timeout(10_000) });
+        if (!resp.ok)
+            throw new Error(`register ${resp.status}`);
+        const data = await resp.json();
+        return data["node_token"] ?? nodeToken;
+    }
+    async function doHeartbeat() {
+        const payload = { node_id: nodeId, intents, load: 0.0, status: "active" };
+        try {
+            await fetch(`${directoryUrl}/heartbeat`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "Authorization": `Bearer ${nodeToken}` },
+                body: JSON.stringify(payload),
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            // heartbeat failures are non-fatal
+        }
+    }
+    let mcpRpcId = 0;
+    async function callMcp(toolName, args) {
+        mcpRpcId += 1;
+        const rpc = { jsonrpc: "2.0", id: mcpRpcId, method: "tools/call", params: { name: toolName, arguments: args } };
+        const resp = await fetch(`${mcpUrl}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(rpc),
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!resp.ok)
+            throw new Error(`MCP server unreachable: ${resp.status}`);
+        const data = await resp.json();
+        if (data["error"])
+            throw new Error(data["error"]["message"] ?? "MCP error");
+        return data["result"];
+    }
+    try {
+        nodeToken = await doRegister();
+        process.stdout.write(`iicp-node mcp-gateway registered as '${nodeId}' with ${activeTools.length} tool(s): ${activeTools.join(", ")}\n` +
+            `  IICP endpoint: ${publicEndpoint}\n  MCP server:    ${mcpUrl}\n`);
+    }
+    catch (err) {
+        process.stderr.write(`WARNING: directory registration failed (${err.message}) — running without listing\n`);
+    }
+    const hbInterval = setInterval(() => { void doHeartbeat(); }, 30_000);
+    const server = http.createServer(async (req, res) => {
+        if (req.method === "GET" && req.url === "/iicp/health") {
+            const body = JSON.stringify({ status: "ok", node_id: nodeId, active_tools: activeTools, mcp_server: mcpUrl, timestamp: Math.floor(Date.now() / 1000) });
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(body);
+            return;
+        }
+        if (req.method === "POST" && req.url === "/v1/task") {
+            const auth = req.headers["authorization"] ?? "";
+            if (!nodeToken || auth !== `Bearer ${nodeToken}`) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            let body;
+            try {
+                body = JSON.parse(Buffer.concat(chunks).toString());
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid JSON" }));
+                return;
+            }
+            const payload = (body["payload"] ?? {});
+            let toolName = payload["tool_name"] ?? "";
+            if (!toolName) {
+                const m = /urn:iicp:intent:mcp:([^:]+):v1/.exec(body["intent"] ?? "");
+                if (m)
+                    toolName = m[1];
+            }
+            if (!toolName) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Cannot determine tool name" }));
+                return;
+            }
+            if (_MCP_DANGEROUS.has(toolName.toLowerCase())) {
+                res.writeHead(403, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Tool not permitted" }));
+                return;
+            }
+            if (activeTools.length && !activeTools.includes(toolName)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Tool not available" }));
+                return;
+            }
+            const taskId = body["task_id"] ?? (0, node_crypto_1.randomUUID)();
+            try {
+                const result = await callMcp(toolName, (payload["arguments"] ?? {}));
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ task_id: taskId, status: "completed", result }));
+            }
+            catch (err) {
+                const msg = err.message ?? "error";
+                const code = msg.includes("unreachable") ? 502 : 422;
+                res.writeHead(code, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: msg }));
+            }
+            return;
+        }
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not found" }));
+    });
+    await new Promise((resolve) => {
+        server.listen(port, host === "::" ? "::" : host, () => {
+            process.stdout.write(`  Listening on ${host}:${port}\n`);
+            resolve();
+        });
+    });
+    await new Promise((resolve) => {
+        process.on("SIGINT", () => { clearInterval(hbInterval); server.close(); resolve(); });
+        process.on("SIGTERM", () => { clearInterval(hbInterval); server.close(); resolve(); });
+    });
+    return 0;
+}
 /** Command dispatch — separated so main() can wrap parse failures as clean CliError output. */
 async function dispatch(argv) {
     const cmd = argv[0];
@@ -1606,6 +1851,8 @@ async function dispatch(argv) {
         return runOperator(argv.slice(1));
     if (cmd === "proxy")
         return runProxyCmd(argv.slice(1));
+    if (cmd === "mcp-gateway")
+        return runMcpGateway(argv.slice(1));
     if (cmd !== "serve") {
         process.stderr.write(`unknown command: ${cmd}\n`);
         printHelp();
@@ -1628,6 +1875,8 @@ async function dispatch(argv) {
             port: { type: "string" },
             host: { type: "string" },
             "skip-registration": { type: "boolean" },
+            tunnel: { type: "boolean" },
+            "no-tunnel": { type: "boolean" },
             force: { type: "boolean" },
             "auto-detect-nat": { type: "boolean" },
             // Parity with Python's BooleanOptionalAction: an explicit off-switch for NAT
@@ -1683,6 +1932,14 @@ async function dispatch(argv) {
             ?? envOr("IICP_EXTERNAL_IP_PROBE_URL")
             ?? "https://api.ipify.org",
         relayWorkerEndpoint: values["relay-worker-endpoint"] ?? envOr("IICP_RELAY_WORKER_ENDPOINT") ?? "",
+        // #520 rung 5 tri-state: --tunnel > --no-tunnel > IICP_TUNNEL env > auto (undefined).
+        tunnel: values["tunnel"]
+            ? true
+            : values["no-tunnel"]
+                ? false
+                : process.env.IICP_TUNNEL !== undefined
+                    ? envBool("IICP_TUNNEL")
+                    : undefined,
         relayCapable: values["relay-capable"] !== undefined
             ? Boolean(values["relay-capable"])
             : envBool("IICP_RELAY_CAPABLE"),