@lifeaitools/clauth 2.1.1 → 2.10.0

package/cli/http/components/tunnel-component.js

@@ -0,0 +1,508 @@
+// cli/http/components/tunnel-component.js
+// The Tunnel component: cloudflared tunnel lifecycle (start/stop/status),
+// Cloudflare API setup wizard (token verify, list/create tunnels, save config,
+// DNS routing), and diagnostics (roundtrip test, binary presence check).
+// Registered via dependency injection -- these handlers close over the live
+// daemon's tunnel process state (tunnelProc/tunnelUrl/tunnelError/tunnelStatus/
+// tunnelHostname), which stays as plain "let" variables inside createServer();
+// ctx.tunnel exposes them as get/set accessors so this file can read and
+// mutate the SAME variables without serve.js needing a file-wide state-object
+// refactor to thread them through.
+import { deriveToken } from "../../fingerprint.js";
+import * as api from "../../api.js";
+import { operation } from "../../supervisor-registry.js";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { readBody } from "../request-utils.js";
+
+const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
+
+export function registerTunnelRoutes(ctx) {
+  ctx.registerReadOnlyRoute("GET", "/tunnel", async (req, res) =>
+    ctx.ok(res, {
+      status: ctx.tunnel.status,
+      running: !!ctx.tunnel.proc,
+      url: ctx.tunnel.url || null,
+      sseUrl: ctx.tunnel.url && ctx.tunnel.url.startsWith("http") ? `${ctx.tunnel.url}/sse` : null,
+      error: ctx.tunnel.error || null,
+    }));
+  ctx.registerReadOnlyRoute("GET", "/tunnel/test", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      if (!ctx.tunnel.url || !ctx.tunnel.url.startsWith("http")) {
+        return ctx.ok(res, { ok: false, reason: "Tunnel not connected" });
+      }
+      const start = Date.now();
+      try {
+        // Hit /ping through the public tunnel URL — proves full roundtrip
+        const resp = await fetch(ctx.tunnel.url + "/ping", { signal: AbortSignal.timeout(8000) });
+        const data = await resp.json();
+        const latencyMs = Date.now() - start;
+        if (data.status === "ok") {
+          // Also verify SSE endpoint is reachable
+          const sseResp = await fetch(ctx.tunnel.url + "/sse", { signal: AbortSignal.timeout(5000) });
+          const sseOk = sseResp.headers.get("content-type")?.includes("text/event-stream");
+          sseResp.body?.cancel?.();
+          return ctx.ok(res, {
+            ok: true,
+            latencyMs,
+            tunnelUrl: ctx.tunnel.url,
+            sseUrl: ctx.tunnel.url + "/sse",
+            sseReachable: !!sseOk,
+            pid: data.pid,
+          });
+        }
+        return ctx.ok(res, { ok: false, reason: "Ping returned unexpected response", data });
+      } catch (e) {
+        return ctx.ok(res, { ok: false, reason: e.message, latencyMs: Date.now() - start });
+      }
+  });
+  ctx.registerReadOnlyRoute("GET", "/tunnel/setup/cf-tunnels", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      try {
+        const { token: t, timestamp } = deriveToken(ctx.password, ctx.machineHash);
+        const cr = await api.retrieve(ctx.password, ctx.machineHash, t, timestamp, "cloudflare");
+        const cfToken = cr?.value;
+        if (!cfToken) return ctx.strike(res, 400, "No cloudflare token in vault");
+
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+        const acctResp = await fetch(
+          `${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+          { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) }
+        );
+        const acctRows = await acctResp.json();
+        const accountId = acctRows?.[0]?.value ? JSON.parse(acctRows[0].value) : null;
+        if (!accountId) return ctx.strike(res, 400, "No account ID — run cf-token first");
+
+        const tr = await fetch(
+          `https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel?is_deleted=false`,
+          { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) }
+        );
+        const td = await tr.json();
+        return ctx.ok(res, { tunnels: (td?.result || []).map(t => ({ id: t.id, name: t.name, status: t.status, created_at: t.created_at })) });
+      } catch (err) {
+        return ctx.strike(res, 502, err.message);
+      }
+  });
+  ctx.registerReadOnlyRoute("GET", "/tunnel/setup/check-cloudflared", async (req, res) => {
+      let cfBin = "cloudflared";
+      let installed = false;
+      if (os.platform() === "win32") {
+        const candidates = [
+          "cloudflared",
+          path.join(process.env.ProgramFiles || "", "cloudflared", "cloudflared.exe"),
+          path.join(process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)", "cloudflared", "cloudflared.exe"),
+          path.join(os.homedir(), "scoop", "shims", "cloudflared.exe"),
+          "C:\\ProgramData\\chocolatey\\bin\\cloudflared.exe",
+        ];
+        for (const c of candidates) {
+          try { if (fs.statSync(c).isFile()) { cfBin = c; installed = true; break; } } catch {}
+        }
+      }
+      if (!installed) {
+        try {
+          const { execSync: es } = await import("child_process");
+          es("cloudflared --version", { stdio: "ignore" });
+          installed = true; cfBin = "cloudflared";
+        } catch {}
+      }
+      return ctx.ok(res, { installed, path: installed ? cfBin : null });
+  });
+  ctx.registerWriteRoute("POST", "/tunnel", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON" }));
+      }
+      if (body.action === "stop") {
+        ctx.stopTunnel();
+        operation("tunnel.stop", {}, null, { ok: true });
+        return ctx.ok(res, { status: ctx.tunnel.status, running: false });
+      }
+      // start
+      await ctx.startTunnel();
+      operation("tunnel.start", {}, null, { ok: !!ctx.tunnel.proc, url: ctx.tunnel.url, error: ctx.tunnel.error });
+      return ctx.ok(res, { status: ctx.tunnel.status, running: !!ctx.tunnel.proc, url: ctx.tunnel.url, error: ctx.tunnel.error });
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/start", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      if (ctx.tunnel.proc) return ctx.ok(res, { status: ctx.tunnel.status, message: "already running" });
+      ctx.tunnel.status = "starting";
+      ctx.startTunnel().catch(() => {});
+      operation("tunnel.start", {}, null, { ok: true, status: "starting" });
+      return ctx.ok(res, { status: "starting" });
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/stop", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      ctx.stopTunnel();
+      operation("tunnel.stop", {}, null, { ok: true });
+      return ctx.ok(res, { status: ctx.tunnel.status });
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/setup/cf-token", async (req, res) => {
+      if (ctx.writeGuard(req, res)) return;
+      let body;
+      try { body = await readBody(req); } catch { return ctx.strike(res, 400, "Invalid JSON"); }
+      const { token: cfToken } = body;
+      if (!cfToken) return ctx.strike(res, 400, "token required");
+
+      try {
+        const vr = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", {
+          headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000)
+        });
+        const vd = await vr.json();
+        if (!vd?.success) return ctx.strike(res, 400, "Invalid Cloudflare API token");
+
+        const ar = await fetch("https://api.cloudflare.com/client/v4/accounts", {
+          headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000)
+        });
+        const ad = await ar.json();
+        const accountId = ad?.result?.[0]?.id;
+        const accountName = ad?.result?.[0]?.name;
+
+        // Save token to vault using the same guarded recovery path as /set/:service.
+        await writeCredentialWithRecovery({ password: ctx.password, machineHash: ctx.machineHash, service: "cloudflare", value: cfToken, logFile: LOG_FILE });
+
+        // Save accountId to clauth_config
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+        if (accountId) {
+          await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+            method: "POST",
+            headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+            body: JSON.stringify({ key: "cf_account_id", value: accountId }),
+          });
+        }
+
+        operation("tunnel.setup.cf_token", {}, null, { ok: true, accountId, accountName });
+        return ctx.ok(res, { ok: true, accountId, accountName });
+      } catch (err) {
+        operation("tunnel.setup.cf_token", {}, null, { ok: false, error: err.message });
+        return ctx.strike(res, 502, err.message);
+      }
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/setup/cf-save", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      let body;
+      try { body = await readBody(req); } catch { return ctx.strike(res, 400, "Invalid JSON"); }
+      const { tunnelId, tunnelName, hostname } = body;
+      if (!hostname) return ctx.strike(res, 400, "hostname required");
+
+      try {
+        const cfDir = path.join(os.homedir(), ".cloudflared");
+        if (!fs.existsSync(cfDir)) fs.mkdirSync(cfDir, { recursive: true });
+        const credFile = tunnelId ? path.join(cfDir, `${tunnelId}.json`) : path.join(cfDir, "tunnel.json");
+        const configContent = `tunnel: ${tunnelId || tunnelName || "clauth"}\ncredentials-file: ${credFile}\ningress:\n  - hostname: ${hostname}\n    service: http://127.0.0.1:${ctx.port}\n  - service: http_status:404\n`;
+        fs.writeFileSync(path.join(cfDir, "config.yml"), configContent, "utf8");
+
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+        await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+          method: "POST",
+          headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+          body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
+        });
+
+        // Persist tunnel_id too — required for token-based self-heal after a
+        // daemon restart or a ~/.cloudflared wipe (getTunnelRunToken reads it).
+        if (tunnelId) {
+          await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+            method: "POST",
+            headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+            body: JSON.stringify({ key: "tunnel_id", value: JSON.stringify(tunnelId) }),
+          });
+        }
+
+        ctx.tunnel.hostname = hostname;
+        ctx.tunnel.url = `https://${hostname}`;
+
+        operation("tunnel.setup.cf_save", { hostname, tunnelId }, null, { ok: true });
+        return ctx.ok(res, { ok: true, hostname });
+      } catch (err) {
+        operation("tunnel.setup.cf_save", { hostname }, null, { ok: false, error: err.message });
+        return ctx.strike(res, 502, err.message);
+      }
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/setup/cf-create-api", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      let body;
+      try { body = await readBody(req); } catch { return ctx.strike(res, 400, "Invalid JSON"); }
+      const { name, hostname, accountId: bodyAccountId } = body;
+      if (!name || !hostname) return ctx.strike(res, 400, "name and hostname required");
+      try {
+        const { token: t, timestamp } = deriveToken(ctx.password, ctx.machineHash);
+        const cr = await api.retrieve(ctx.password, ctx.machineHash, t, timestamp, "cloudflare");
+        const cfToken = cr?.value;
+        if (!cfToken) return ctx.strike(res, 400, "No cloudflare token in vault");
+
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+
+        // Get accountId
+        let accountId = bodyAccountId;
+        if (!accountId) {
+          const acctResp = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          const rows = await acctResp.json();
+          accountId = rows?.[0]?.value ? JSON.parse(rows[0].value) : null;
+        }
+        if (!accountId) return ctx.strike(res, 400, "No account ID — verify CF token first");
+
+        // Generate tunnel secret (32 random bytes base64)
+        const { randomBytes } = await import("crypto");
+        const tunnelSecret = randomBytes(32).toString("base64");
+
+        // Create tunnel via CF API
+        const createResp = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${cfToken}`, "Content-Type": "application/json" },
+          body: JSON.stringify({ name, tunnel_secret: tunnelSecret }),
+          signal: AbortSignal.timeout(10000),
+        });
+        const createData = await createResp.json();
+        if (!createData?.success) return ctx.strike(res, 400, createData?.errors?.[0]?.message || "Tunnel creation failed");
+        const tunnelId = createData.result.id;
+
+        // Write credentials file
+        const cfDir = path.join(os.homedir(), ".cloudflared");
+        if (!fs.existsSync(cfDir)) fs.mkdirSync(cfDir, { recursive: true });
+        const credFile = path.join(cfDir, `${tunnelId}.json`);
+        fs.writeFileSync(credFile, JSON.stringify({ AccountTag: accountId, TunnelID: tunnelId, TunnelName: name, TunnelSecret: tunnelSecret }), "utf8");
+
+        // Write config.yml
+        const configContent = `tunnel: ${tunnelId}\ncredentials-file: ${credFile}\ningress:\n  - hostname: ${hostname}\n    service: http://127.0.0.1:${ctx.port}\n  - service: http_status:404\n`;
+        fs.writeFileSync(path.join(cfDir, "config.yml"), configContent, "utf8");
+
+        // Route DNS via CF API — find zone for hostname
+        const domain = hostname.split(".").slice(-2).join(".");
+        const zoneResp = await fetch(`https://api.cloudflare.com/client/v4/zones?name=${domain}`,
+          { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+        const zoneData = await zoneResp.json();
+        const zoneId = zoneData?.result?.[0]?.id;
+        if (zoneId) {
+          await fetch(`https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${cfToken}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ type: "CNAME", name: hostname, content: `${tunnelId}.cfargotunnel.com`, proxied: false, ttl: 1 }),
+            signal: AbortSignal.timeout(8000),
+          });
+        }
+
+        // Save hostname to DB and in-process
+        await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+          method: "POST",
+          headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+          body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
+        });
+        ctx.tunnel.hostname = hostname;
+        ctx.tunnel.url = `https://${hostname}`;
+
+        operation("tunnel.setup.cf_create_api", { hostname, tunnelId }, null, { ok: true });
+        return ctx.ok(res, { ok: true, tunnelId, hostname });
+      } catch (err) {
+        operation("tunnel.setup.cf_create_api", { hostname }, null, { ok: false, error: err.message });
+        return ctx.strike(res, 502, err.message);
+      }
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/setup/cf-login", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", ...ctx.CORS });
+      const sendEvt = (data) => res.write(`data: ${JSON.stringify(data)}\n\n`);
+      try {
+        const { spawn } = await import("child_process");
+        const proc = spawn("cloudflared", ["tunnel", "login"], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
+        proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
+        proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
+        proc.on("close", code => {
+          operation("tunnel.setup.cf_login", {}, null, { ok: code === 0, exit_code: code });
+          sendEvt({ done: true, code }); res.end();
+        });
+        req.on("close", () => { try { proc.kill(); } catch {} });
+      } catch (err) {
+        operation("tunnel.setup.cf_login", {}, null, { ok: false, error: err.message });
+        sendEvt({ done: true, code: 1, error: err.message });
+        res.end();
+      }
+      return;
+  });
+  ctx.registerWriteRoute("POST", "/tunnel/setup/cf-create", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON" }));
+      }
+      const { name, hostname } = body;
+      if (!name || !hostname) {
+        res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ error: "name and hostname required" }));
+      }
+      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", ...ctx.CORS });
+      const sendEvt = (data) => res.write(`data: ${JSON.stringify(data)}\n\n`);
+      try {
+        const { spawn } = await import("child_process");
+
+        // Step 1: create tunnel
+        sendEvt({ line: `Creating tunnel "${name}"…`, step: 1 });
+        let tunnelId = null;
+        await new Promise((resolve, reject) => {
+          const proc = spawn("cloudflared", ["tunnel", "create", name], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
+          let output = "";
+          proc.stdout.on("data", d => { const s = d.toString(); output += s; s.split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 1 })); });
+          proc.stderr.on("data", d => { const s = d.toString(); output += s; s.split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 1 })); });
+          proc.on("close", code => {
+            const m = output.match(/Created tunnel .+ with id ([a-f0-9-]{36})/i);
+            if (m) tunnelId = m[1];
+            if (code !== 0 && !tunnelId) reject(new Error(`create failed (exit ${code})`));
+            else resolve();
+          });
+        });
+
+        if (!tunnelId) {
+          sendEvt({ error: "Could not parse tunnel ID from cloudflared output" });
+          return res.end();
+        }
+
+        // Step 2: route DNS
+        sendEvt({ line: `Routing DNS: ${hostname}…`, step: 2 });
+        await new Promise((resolve) => {
+          const proc = spawn("cloudflared", ["tunnel", "route", "dns", name, hostname], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
+          proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 2 })));
+          proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 2 })));
+          proc.on("close", () => resolve());
+        });
+
+        // Step 3: save config
+        const cfDir = path.join(os.homedir(), ".cloudflared");
+        if (!fs.existsSync(cfDir)) fs.mkdirSync(cfDir, { recursive: true });
+        const credFile = path.join(cfDir, `${tunnelId}.json`);
+        const configContent = `tunnel: ${tunnelId}\ncredentials-file: ${credFile}\ningress:\n  - hostname: ${hostname}\n    service: http://127.0.0.1:${ctx.port}\n  - service: http_status:404\n`;
+        fs.writeFileSync(path.join(cfDir, "config.yml"), configContent, "utf8");
+
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+        await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+          method: "POST",
+          headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+          body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
+        });
+        ctx.tunnel.hostname = hostname;
+        ctx.tunnel.url = `https://${hostname}`;
+
+        operation("tunnel.setup.cf_create", { name, hostname, tunnelId }, null, { ok: true });
+        sendEvt({ done: true, tunnelId, hostname });
+        res.end();
+      } catch (err) {
+        operation("tunnel.setup.cf_create", { name, hostname }, null, { ok: false, error: err.message });
+        sendEvt({ error: err.message, done: true });
+        res.end();
+      }
+      return;
+  });
+  // GET /tunnel/setup-state
+  ctx.registerWriteRoute("GET", "/tunnel/setup-state", async (req, res) => {
+      if (ctx.lockedGuard(res)) return;
+      try {
+        const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+        const sbKey = api.getAnonKey();
+
+        // Check for existing hostname in DB
+        const hostnameResp = await fetch(
+          `${sbUrl}/rest/v1/clauth_config?key=eq.tunnel_hostname&select=value`,
+          { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) }
+        );
+        if (hostnameResp.ok) {
+          const rows = await hostnameResp.json();
+          if (rows.length > 0 && rows[0].value && rows[0].value !== "null" && rows[0].value !== '""') {
+            const hn = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            if (hn) return ctx.ok(res, { step: "ready", hostname: hn });
+          }
+        }
+
+        // Check ~/.cloudflared/config.yml for a previously configured tunnel
+        try {
+          const cfConfig = path.join(os.homedir(), ".cloudflared", "config.yml");
+          if (fs.existsSync(cfConfig)) {
+            const cfYml = fs.readFileSync(cfConfig, "utf8");
+            // Parse hostname from ingress block: "  - hostname: <hostname>"
+            const hostMatch = cfYml.match(/^\s*-\s*hostname:\s*(\S+)/m);
+            const tunnelMatch = cfYml.match(/^tunnel:\s*(\S+)/m);
+            if (hostMatch && tunnelMatch) {
+              const localHostname = hostMatch[1];
+              const localTunnelId = tunnelMatch[1];
+              // Save to DB so next load skips this check
+              await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+                method: "POST",
+                headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+                body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(localHostname) }),
+              });
+              ctx.tunnel.hostname = localHostname;
+              return ctx.ok(res, { step: "ready", hostname: localHostname, tunnelId: localTunnelId, source: "local_config" });
+            }
+          }
+        } catch {}
+
+        // Check for CF token in vault
+        let cfToken = null;
+        try {
+          const { token: t, timestamp } = deriveToken(ctx.password, ctx.machineHash);
+          const cr = await api.retrieve(ctx.password, ctx.machineHash, t, timestamp, "cloudflare");
+          if (cr?.value) cfToken = cr.value;
+        } catch {}
+
+        if (!cfToken) return ctx.ok(res, { step: "need_cf_token" });
+
+        // Get or fetch account ID
+        let accountId = null;
+        try {
+          const acctResp = await fetch(
+            `${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) }
+          );
+          if (acctResp.ok) {
+            const rows = await acctResp.json();
+            if (rows.length > 0 && rows[0].value) {
+              accountId = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+
+        if (!accountId) {
+          try {
+            const ar = await fetch("https://api.cloudflare.com/client/v4/accounts", {
+              headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000)
+            });
+            const ad = await ar.json();
+            accountId = ad?.result?.[0]?.id;
+            if (accountId) {
+              await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+                method: "POST",
+                headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+                body: JSON.stringify({ key: "cf_account_id", value: accountId }),
+              });
+            }
+          } catch {}
+        }
+
+        if (!accountId) return ctx.ok(res, { step: "setup_wizard", error: "Could not get Cloudflare account ID" });
+
+        // List tunnels
+        try {
+          const tr = await fetch(
+            `https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel?is_deleted=false`,
+            { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) }
+          );
+          const td = await tr.json();
+          const tunnels = (td?.result || []).map(t => ({ id: t.id, name: t.name, status: t.status }));
+          if (tunnels.length > 0) return ctx.ok(res, { step: "pick_tunnel", tunnels, accountId });
+          // CF token exists but no tunnels — create via API (no cloudflared login needed)
+          return ctx.ok(res, { step: "no_tunnels", accountId });
+        } catch {}
+
+        return ctx.ok(res, { step: "setup_wizard" });
+      } catch (err) {
+        return ctx.ok(res, { step: "setup_wizard", error: err.message });
+      }
+  });
+}