@maintainer-pro/ai-bridge 0.1.14 → 0.1.16

package/src/daemon.mjs

@@ -23,8 +23,14 @@ import {
   lookupShareResponse,
   prepareShareHttpRequest,
   processShareHttpResponse,
-  shouldRewriteBody,
+  shouldProcessShareResponse,
 } from "./share-rewrite.mjs";
+import {
+  canonicalActionCode,
+  isDiscardedTunnelUrl,
+  leftoverStateKeys,
+  LEGACY_TUNNEL_FILE,
+} from "./discarded-tunnels.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_VERSION = readPackageVersion();
@@ -387,8 +393,7 @@ async function resolveWorkspaceHostApps(ws, opts = {}) {
     const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
     result.apps = result.apps.map((app) => {
       const match = previous.find((row) => row && row.id === app.id);
-      if (!match || (app.envMaps && app.envMaps.length)) return app;
-      return { ...app, envMaps: match.envMaps || [] };
+      return match ? { ...app, host: match.host === true || app.host === true } : app;
     });
     ws.hostApps = result.apps;
     if (opts.cfg) persistWorkspaceEntry(opts.cfg, ws);
@@ -819,6 +824,67 @@ function probeUrl(url, timeoutMs = 2500) {
   });
 }
 
+/** Some Windows apps bind `localhost` (::1) but refuse `127.0.0.1`. */
+const LOOPBACK_HOSTS = ["127.0.0.1", "localhost"];
+/** @type {Map<number, string>} */
+const loopbackHostByPort = new Map();
+
+function isLoopbackConnError(err) {
+  const code = err && typeof err === "object" ? String(err.code || "") : "";
+  return (
+    code === "ECONNREFUSED" ||
+    code === "EHOSTUNREACH" ||
+    code === "EADDRNOTAVAIL" ||
+    code === "ENOTFOUND" ||
+    code === "ETIMEDOUT"
+  );
+}
+
+function loopbackHostsForPort(port) {
+  const cached = loopbackHostByPort.get(Number(port));
+  if (cached === "localhost") return ["localhost", "127.0.0.1"];
+  return LOOPBACK_HOSTS;
+}
+
+function rememberLoopbackHost(port, host) {
+  const n = Number(port);
+  const name = String(host || "").trim();
+  if (n && (name === "127.0.0.1" || name === "localhost")) {
+    loopbackHostByPort.set(n, name);
+  }
+}
+
+function loopbackUrlVariants(url) {
+  try {
+    const parsed = new URL(String(url));
+    const host = String(parsed.hostname || "").toLowerCase();
+    if (host !== "localhost" && host !== "127.0.0.1") return [String(url)];
+    const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+    return loopbackHostsForPort(port).map((name) => {
+      const next = new URL(parsed);
+      next.hostname = name;
+      return next.toString();
+    });
+  } catch {
+    return [String(url)];
+  }
+}
+
+async function probeLoopbackUrl(url, timeoutMs = 2500) {
+  for (const candidate of loopbackUrlVariants(url)) {
+    if (await probeUrl(candidate, timeoutMs)) {
+      try {
+        const parsed = new URL(candidate);
+        rememberLoopbackHost(parsed.port, parsed.hostname);
+      } catch {
+        /* ignore */
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 function adminListenPort(cfg = bridgeCfg) {
   try {
     const u = new URL(String(cfg?.adminUrl || "http://localhost:4100"));
@@ -1027,9 +1093,8 @@ function mergeEnvFile(file, values, opts = {}) {
 }
 
 /**
- * Do not write Maintainer Pro keys into the app. The bridge injects env into
- * the process it launches (terminal script / in-process chat).
- * Only strip leftover trycloudflare values we previously wrote.
+ * Do not write Maintainer Pro keys or share URLs into the app.
+ * Only strip leftover tunnel URLs we previously wrote.
  */
 function writeProjectEnv(folder, _values, opts = {}) {
   const remove = (opts.remove || []).filter(Boolean);
@@ -1061,37 +1126,9 @@ function readProjectEnvValues(folder) {
   return map;
 }
 
-function isTryCloudflareUrl(value) {
-  try {
-    return new URL(String(value || "").trim()).hostname.endsWith(
-      ".trycloudflare.com"
-    );
-  } catch {
-    return false;
-  }
-}
-
-function readCloudflareTunnelFile(folder) {
-  if (!folder) return null;
-  const file = path.join(path.resolve(folder), ".cloudflare-tunnel-url");
-  if (!fs.existsSync(file)) return null;
-  /** @type {Record<string, string>} */
-  const tunnels = {};
-  for (const raw of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq < 1) continue;
-    const role = line.slice(0, eq).trim();
-    const url = line.slice(eq + 1).trim().replace(/\/$/, "");
-    if (role && isTryCloudflareUrl(url)) tunnels[role] = url;
-  }
-  return Object.keys(tunnels).length ? tunnels : null;
-}
-
-function clearCloudflareTunnelFile(folder) {
+function clearLegacyTunnelFile(folder) {
   if (!folder) return;
-  const file = path.join(path.resolve(folder), ".cloudflare-tunnel-url");
+  const file = path.join(path.resolve(folder), LEGACY_TUNNEL_FILE);
   try {
     if (fs.existsSync(file)) fs.unlinkSync(file);
   } catch {
@@ -1099,8 +1136,7 @@ function clearCloudflareTunnelFile(folder) {
   }
 }
 
-/** Stop rediscovering dead trycloudflare URLs from old cloudflared logs. */
-function archiveStaleCloudflareLogs(folder, sandboxId) {
+function archiveLegacyTunnelLogs(folder, sandboxId) {
   if (!folder) return;
   const logDir = dataDirFor(folder, sandboxId);
   if (!fs.existsSync(logDir)) return;
@@ -1123,185 +1159,25 @@ function archiveStaleCloudflareLogs(folder, sandboxId) {
   }
 }
 
-const CLOUDFLARE_ENV_KEYS = [
-  "APP_URL",
-  "PUBLIC_URL",
-  "CORS_ORIGIN",
-  "CORS_ORIGINS",
-  "NEXT_PUBLIC_APP_URL",
-  "VITE_APP_URL",
-  "REACT_APP_APP_URL",
-  "AI_SERVER_URL",
-  "NEXT_PUBLIC_AI_SERVER_URL",
-  "VITE_AI_SERVER_URL",
-  "REACT_APP_AI_SERVER_URL",
-  "API_URL",
-  "API_BASE_URL",
-  "VITE_API_URL",
-  "VITE_API_BASE_URL",
-  "NEXT_PUBLIC_API_URL",
-  "NEXT_PUBLIC_API_BASE_URL",
-  "BACKEND_URL",
-];
-
-/**
- * Remove dead trycloudflare URLs from workspace state, tunnel file, env, and
- * archived logs so heartbeats stop re-probing them.
- */
-function purgeUnreachableCloudflare(ws, cfg, opts = {}) {
+/** Drop leftover tunnel state so heartbeats never revive old public URLs. */
+function stripDiscardedTunnelState(ws, cfg) {
   const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
-  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-  const deadUrls = (opts.deadUrls || [])
-    .map((u) => String(u || "").replace(/\/$/, ""))
-    .filter((u) => isTryCloudflareUrl(u));
-  const keep = opts.keep && typeof opts.keep === "object" ? opts.keep : null;
-
-  if (deadUrls.length) {
-    log(
-      `clearing stale Cloudflare for ${label}: ${deadUrls.join(", ")}`
+  const leftoverKeys = leftoverStateKeys(ws);
+  const had = leftoverKeys.length > 0 || isDiscardedTunnelUrl(ws.appUrl);
+  for (const key of leftoverKeys) delete ws[key];
+  if (isDiscardedTunnelUrl(ws.appUrl)) ws.appUrl = null;
+
+  if (folder && fs.existsSync(folder)) {
+    archiveLegacyTunnelLogs(folder, ws.sandboxId);
+    clearLegacyTunnelFile(folder);
+    const current = readProjectEnvValues(folder);
+    const remove = Object.keys(current).filter((key) =>
+      isDiscardedTunnelUrl(current[key])
     );
-  } else {
-    log(`clearing stale Cloudflare for ${label}`);
-  }
-
-  ws.cloudflareUrl = null;
-  ws.cloudflare = keep && Object.keys(keep).length ? { ...keep } : null;
-  if (keep?.ui || keep?.ai) {
-    ws.cloudflareUrl = keep.ui || keep.ai;
-    ws.appUrl = keep.ui || keep.ai;
-  } else if (ws.appUrl && !isLocalAppUrl(ws.appUrl)) {
-    ws.appUrl = null;
-  }
-
-  if (ws.sandboxId && !(keep && Object.keys(keep).length)) {
-    cloudflareTunnels.delete(ws.sandboxId);
+    if (remove.length) writeProjectEnv(folder, {}, { remove });
   }
 
-  if (!folder || !fs.existsSync(folder)) {
-    persistWorkspaceEntry(cfg, ws);
-    return;
-  }
-
-  // Always archive cf-*.log so dead trycloudflare hosts are not rediscovered.
-  archiveStaleCloudflareLogs(folder, ws.sandboxId);
-  if (keep && Object.keys(keep).length) {
-    writeTunnelEnv(ws, keep);
-  } else {
-    clearCloudflareTunnelFile(folder);
-  }
-
-  const current = readProjectEnvValues(folder);
-  /** @type {string[]} */
-  const remove = [];
-  for (const key of CLOUDFLARE_ENV_KEYS) {
-    const value = current[key];
-    if (!isTryCloudflareUrl(value)) continue;
-    const normalized = String(value).replace(/\/$/, "");
-    if (keep && Object.values(keep).some((u) => String(u).replace(/\/$/, "") === normalized)) {
-      continue;
-    }
-    remove.push(key);
-  }
-  if (remove.length) {
-    writeProjectEnv(folder, {}, { remove });
-  }
-
-  persistWorkspaceEntry(cfg, ws);
-}
-
-function parseAllTryCloudflareUrls(text) {
-  const matches = [
-    ...String(text || "").matchAll(
-      /https:\/\/[a-z0-9-]+\.trycloudflare\.com/gi
-    ),
-  ];
-  return matches.map((m) => m[0].replace(/\/$/, ""));
-}
-
-function lastTryCloudflareUrl(text) {
-  const all = parseAllTryCloudflareUrls(text);
-  return all.length ? all[all.length - 1] : null;
-}
-
-/**
- * Discover Cloudflare tunnel URLs from bridge state, tunnel file, project env,
- * and cloudflared log files — even if this bridge process did not start them.
- * @returns {Record<string, string> | null}
- */
-function discoverCloudflareTunnels(ws) {
-  if (!ws?.folderPath) return null;
-  const folder = path.resolve(ws.folderPath);
-  /** @type {Record<string, string>} */
-  const tunnels = {};
-  const setRole = (role, value) => {
-    if (!role || tunnels[role] || !isTryCloudflareUrl(value)) return;
-    tunnels[role] = String(value).replace(/\/$/, "");
-  };
-
-  if (ws.cloudflare && typeof ws.cloudflare === "object") {
-    for (const [role, value] of Object.entries(ws.cloudflare)) {
-      setRole(role, value);
-    }
-  }
-  if (ws.cloudflareUrl) setRole("ui", ws.cloudflareUrl);
-
-  const fromFile = readCloudflareTunnelFile(folder);
-  if (fromFile) {
-    for (const [role, value] of Object.entries(fromFile)) setRole(role, value);
-  }
-
-  const env = readProjectEnvValues(folder);
-  const envRoles = [
-    ["ai", env.NEXT_PUBLIC_AI_SERVER_URL],
-    ["ai", env.VITE_AI_SERVER_URL],
-    ["ai", env.AI_SERVER_URL],
-    ["ai", env.REACT_APP_AI_SERVER_URL],
-    ["ui", env.NEXT_PUBLIC_APP_URL],
-    ["ui", env.VITE_APP_URL],
-    ["ui", env.APP_URL],
-    ["ui", env.PUBLIC_URL],
-    ["backend", env.NEXT_PUBLIC_API_URL],
-    ["backend", env.VITE_API_URL],
-    ["backend", env.API_URL],
-  ];
-  for (const [role, value] of envRoles) setRole(role, value);
-
-  const logDir = dataDirFor(folder, ws.sandboxId);
-  if (fs.existsSync(logDir)) {
-    const sandboxPrefix = `cf-${String(ws.sandboxId || "").slice(0, 8)}-`;
-    let names = [];
-    try {
-      names = fs.readdirSync(logDir);
-    } catch {
-      names = [];
-    }
-    // Prefer sandbox-scoped logs, then any cf-*-role.log in the project.
-    const ranked = names
-      .filter((name) => /^cf-.*\.log$/i.test(name) && !name.endsWith(".stale"))
-      .sort((a, b) => {
-        const aScore = a.startsWith(sandboxPrefix) ? 0 : 1;
-        const bScore = b.startsWith(sandboxPrefix) ? 0 : 1;
-        return aScore - bScore || a.localeCompare(b);
-      });
-    for (const name of ranked) {
-      const roleMatch = name.match(
-        /cf-(?:[a-f0-9]{6,}-)?(ai|ui|backend|app)\.log$/i
-      );
-      if (!roleMatch) continue;
-      let role = roleMatch[1].toLowerCase();
-      if (role === "app") role = "ui";
-      if (tunnels[role]) continue;
-      try {
-        const text = fs.readFileSync(path.join(logDir, name), "utf8");
-        const url = lastTryCloudflareUrl(text);
-        if (url) setRole(role, url);
-      } catch {
-        /* ignore unreadable logs */
-      }
-    }
-  }
-
-  return Object.keys(tunnels).length ? tunnels : null;
+  if (had) persistWorkspaceEntry(cfg, ws);
 }
 
 function workspaceHostReport(ws) {
@@ -1326,7 +1202,7 @@ function workspaceHostReport(ws) {
     env.NEXT_PUBLIC_AI_SERVER_URL,
     ws.appUrl,
   ]) {
-    if (!value || isTryCloudflareUrl(value)) continue;
+    if (!value || isDiscardedTunnelUrl(value)) continue;
     add(value);
   }
   if (chatPort) {
@@ -1360,7 +1236,7 @@ function workspaceHostReport(ws) {
 /**
  * Status-only reconcile for a workspace:
  * 1) probe chat / ui / backend
- * 2) drop leftover trycloudflare URLs (never start or reuse tunnels)
+ * 2) drop leftover tunnel URLs
  * 3) compute host appUrl + CORS origins for Maintainer Pro
  *
  * Does not start apps. Does not write the app's .env files.
@@ -1375,19 +1251,8 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
     ws.port = probe.chatPort;
   }
 
-  // 2. Remove leftover Cloudflare tunnels / env — share URLs replace them.
-  const leftover = discoverCloudflareTunnels(ws);
-  if (leftover || ws.cloudflareUrl || ws.cloudflare) {
-    purgeUnreachableCloudflare(ws, cfg, {
-      deadUrls: leftover ? Object.values(leftover) : [],
-      keep: null,
-    });
-    try {
-      await stopCloudflare(ws.sandboxId, ws.folderPath);
-    } catch {
-      /* leftover cloudflared */
-    }
-  }
+  // 2. Remove leftover tunnel URLs / env — share URLs replace them.
+  stripDiscardedTunnelState(ws, cfg);
 
   // 3. Host + CORS origins for Maintainer Pro
   const host = workspaceHostReport(ws);
@@ -1445,8 +1310,6 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
 
   return {
     probe,
-    usingCloudflare: false,
-    cloudflare: null,
     host,
     appsRunning: probe.running,
     aiServerUp: probe.chatUp,
@@ -1467,18 +1330,28 @@ async function probeHttpPaths(port, paths, timeoutMs = 2500) {
 function probePortOpen(port, timeoutMs = 800) {
   const n = Number(port);
   if (!n) return Promise.resolve(false);
-  return new Promise((resolve) => {
-    const socket = net.connect({ host: "127.0.0.1", port: n });
-    const done = (ok) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve(ok);
-    };
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => done(true));
-    socket.once("timeout", () => done(false));
-    socket.once("error", () => done(false));
-  });
+  const tryHost = (host) =>
+    new Promise((resolve) => {
+      const socket = net.connect({ host, port: n });
+      const done = (ok) => {
+        socket.removeAllListeners();
+        socket.destroy();
+        resolve(ok);
+      };
+      socket.setTimeout(timeoutMs);
+      socket.once("connect", () => done(true));
+      socket.once("timeout", () => done(false));
+      socket.once("error", () => done(false));
+    });
+  return (async () => {
+    for (const host of loopbackHostsForPort(n)) {
+      if (await tryHost(host)) {
+        rememberLoopbackHost(n, host);
+        return true;
+      }
+    }
+    return false;
+  })();
 }
 
 async function portIsLive(port, timeoutMs = 1200) {
@@ -1605,15 +1478,6 @@ function proxyUrlForApp(ws, app) {
   return `${origin}/p/${token}/${slug}`;
 }
 
-function tunnelRoleForApp(app) {
-  if (!app) return "app";
-  if (app.role === "ai-server") return "ai";
-  if (app.host === true || app.role === "ui" || app.role === "app") return "ui";
-  if (isBackendApp(app)) return "backend";
-  if (app.role === "custom") return "app";
-  return app.role;
-}
-
 function jobsFromHostApps(ws) {
   const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
   const hostId = hostAppOf(ws)?.id;
@@ -1678,7 +1542,6 @@ async function probeRunningApps(ws, timeoutMs = 2500) {
         ...app,
         port: port || app.port,
         running: Boolean(up),
-        cloudflareUrl: null,
         publicUrl: proxyUrlForApp(ws, app) || null,
         lastCheckedAt: new Date().toISOString(),
       };
@@ -1722,66 +1585,20 @@ async function restoreHostsAfterReconnect(cfg) {
   }
 }
 
-function envForWorkspacePorts(ws, jobs) {
+function chatLaunchEnv(ws, cfg) {
   const aiPort = Number(ws.port) || 3100;
-  const aiApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-    (app) => app.role === "ai-server" || app.id === "ai-server"
-  ) || { id: "ai-server", role: "ai-server" };
-  const publicAi = proxyUrlForApp(ws, aiApp) || "";
-  const ai = publicAi || `http://localhost:${aiPort}`;
-  /** @type {Record<string, string>} */
-  const env = {
+  const admin = originFromUrl(cfg?.adminUrl);
+  const origins = [];
+  if (admin) origins.push(admin);
+  origins.push(`http://localhost:${aiPort}`);
+  origins.push(`http://127.0.0.1:${aiPort}`);
+  return {
     AI_SERVER_PORT: String(aiPort),
-    AI_SERVER_URL: ai,
-    NEXT_PUBLIC_AI_SERVER_URL: ai,
-    VITE_AI_SERVER_URL: ai,
-    REACT_APP_AI_SERVER_URL: ai,
     MAINTAINER_PRO_DATA_DIR: dataDirFor(ws.folderPath, ws.sandboxId),
     MAINTAINER_PRO_SANDBOX_ID: String(ws.sandboxId || ""),
+    CORS_ORIGIN: origins.join(","),
+    CORS_ORIGINS: origins.join(","),
   };
-  const ui =
-    jobs.find((job) => job.host) ||
-    jobs.find((job) => job.role === "ui" || job.role === "app");
-  const uiApp =
-    hostAppOf(ws) ||
-    (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-      (app) => app && (app.host || app.role === "ui" || app.role === "app")
-    ) ||
-    { id: "ui", role: "ui", host: true };
-  const publicUi = proxyUrlForApp(ws, uiApp) || "";
-  if (publicUi) {
-    env.PORT = ui?.port ? String(ui.port) : env.PORT;
-    env.APP_URL = publicUi;
-    env.CORS_ORIGIN = publicUi;
-    env.PUBLIC_URL = publicUi;
-    env.NEXT_PUBLIC_APP_URL = publicUi;
-    env.VITE_APP_URL = publicUi;
-  } else if (ui?.port) {
-    const app = `http://localhost:${ui.port}`;
-    env.PORT = String(ui.port);
-    env.APP_URL = app;
-    env.CORS_ORIGIN = app;
-    env.NEXT_PUBLIC_APP_URL = app;
-    env.VITE_APP_URL = app;
-  }
-  const backend = jobs.find((job) => job.role === "backend");
-  if (backend?.port) {
-    const backendApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-      (app) => isBackendApp(app)
-    ) || { id: "backend", role: "backend", port: backend.port };
-    const publicBackend = proxyUrlForApp(ws, backendApp) || "";
-    const api = publicBackend || `http://localhost:${backend.port}`;
-    env.API_URL = api;
-    env.API_BASE_URL = api;
-    env.API_PORT = String(backend.port);
-    env.BACKEND_URL = api;
-    env.VITE_API_URL = api;
-    env.VITE_API_BASE_URL = api;
-    env.NEXT_PUBLIC_API_URL = api;
-    env.NEXT_PUBLIC_API_BASE_URL = api;
-    env.REACT_APP_API_URL = api;
-  }
-  return env;
 }
 
 async function prepareWorkspaceLaunch(ws, cfg, reserved) {
@@ -1790,7 +1607,7 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   if (!folder || !fs.existsSync(folder)) {
     const aiPort = Number(ws.port) || 3100;
     log(`ports skip ${label}: folder missing (${folder || "none"})`);
-    return { aiPort, jobs: [], env: {} };
+    return { aiPort, jobs: [] };
   }
   log(`ports pick ${label} in ${folder}`);
   const listedAi = Array.isArray(ws.hostApps)
@@ -1826,11 +1643,8 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   const planned = [];
   for (const job of jobs) {
     const preferred = Number(job.preferredPort) || 3000;
-    const probe = (job.probeUrl || `http://127.0.0.1:${preferred}`).replace(
-      "localhost",
-      "127.0.0.1"
-    );
-    const up = await probeUrl(probe);
+    const probe = job.probeUrl || `http://127.0.0.1:${preferred}`;
+    const up = await probeLoopbackUrl(probe);
     const port = up
       ? (reserved.add(portFromText(probe, preferred)), portFromText(probe, preferred))
       : await findFreePort(preferred, reserved);
@@ -1850,10 +1664,6 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
     }
   }
 
-  const env = envForWorkspacePorts(ws, planned);
-  log(
-    `env inject ${label} (process only): ${Object.keys(env).join(" ") || "(none)"}`
-  );
   if (planned.length) {
     ws.projectInfo = {
       ...(ws.projectInfo || {}),
@@ -1869,7 +1679,7 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
       .map((job) => ` ${job.role}=${job.port}${job.up ? "(up)" : ""}`)
       .join("")}`
   );
-  return { aiPort, jobs: planned, env };
+  return { aiPort, jobs: planned };
 }
 
 const DEFAULT_AI_IGNORE_PATHS = [
@@ -1934,7 +1744,7 @@ const IGNORE_NAMES = new Set([
   ".maintainer-pro",
   ".collaborater",
   ".maintainer-pro-bridge.json",
-  ".cloudflare-tunnel-url",
+  LEGACY_TUNNEL_FILE,
 ]);
 
 function isIgnorableEntry(name) {
@@ -2204,8 +2014,6 @@ function listLaunchRoots(allowed) {
 
 /** Prevents opening a new window on every heartbeat while a process is starting. */
 const launchedAt = new Map();
-/** @type {Map<string, { tunnels: Array<{ role: string, localUrl: string, publicUrl: string | null, logFile: string }> }>} */
-const cloudflareTunnels = new Map();
 /** In-process chat servers, one per sandbox/project. */
 /** @type {Map<string, { port: number, workspaceDir: string, close: () => Promise<void>, runChat: (body: Record<string, unknown>) => Promise<{ ok: boolean, status: number, data: Record<string, unknown> }>, handleHttp?: Function }>} */
 const embeddedChat = new Map();
@@ -2528,7 +2336,6 @@ function handleProxyHttpFromAdmin(msg) {
     }
   }
   const headers = prepared.headers;
-  headers.host = `127.0.0.1:${port}`;
   // Next.js dev 403s `/_next` when Origin/sec-fetch look cross-site.
   // This hop is server-to-server; drop those so chunks always load.
   for (const key of Object.keys(headers)) {
@@ -2545,91 +2352,126 @@ function handleProxyHttpFromAdmin(msg) {
     }
   }
   const stream = randomBytes(8).toString("hex");
-  let req;
-  try {
-    req = http.request(
-      {
-        hostname: "127.0.0.1",
-        port,
-        path,
-        method,
-        headers,
-        agent: proxyKeepAliveAgent,
-      },
-      (res) => {
-        /** @type {Record<string, string>} */
-        const outHeaders = {};
-        for (const [key, value] of Object.entries(res.headers)) {
-          if (value == null) continue;
-          outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
-        }
-        const status = res.statusCode || 502;
-        applyShareCacheHeaders(outHeaders, path);
-        if (shouldRewriteBody(outHeaders)) {
-          /** @type {Buffer[]} */
-          const chunks = [];
+  const initialBody =
+    typeof msg.body === "string" && msg.body
+      ? Buffer.from(msg.body, "base64")
+      : null;
+  const endAfter = msg.bodyEof !== false;
+  const hosts = loopbackHostsForPort(port);
+  let hostIndex = 0;
+
+  const connect = () => {
+    const host = hosts[hostIndex];
+    const reqHeaders = { ...headers, host: `${host}:${port}` };
+    let req;
+    try {
+      req = http.request(
+        {
+          hostname: host,
+          port,
+          path,
+          method,
+          headers: reqHeaders,
+          agent: proxyKeepAliveAgent,
+        },
+        (res) => {
+          rememberLoopbackHost(port, host);
+          /** @type {Record<string, string>} */
+          const outHeaders = {};
+          for (const [key, value] of Object.entries(res.headers)) {
+            if (value == null) continue;
+            outHeaders[key] = Array.isArray(value)
+              ? value.join(", ")
+              : String(value);
+          }
+          const status = res.statusCode || 502;
+          applyShareCacheHeaders(outHeaders, path);
+          if (shouldProcessShareResponse(outHeaders)) {
+            /** @type {Buffer[]} */
+            const chunks = [];
+            res.on("data", (chunk) => {
+              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            res.on("end", () => {
+              proxyHttpReqs.delete(id);
+              sendProcessedProxyHttp(
+                id,
+                ctx,
+                status,
+                outHeaders,
+                Buffer.concat(chunks)
+              );
+            });
+            return;
+          }
+          bridgeSend({
+            type: "proxy.http.start",
+            id,
+            stream,
+            status,
+            headers: outHeaders,
+          });
           res.on("data", (chunk) => {
-            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            for (
+              let offset = 0;
+              offset < buf.length;
+              offset += PROXY_CHUNK_BYTES
+            ) {
+              const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+              bridgeSend({
+                type: "proxy.http.chunk",
+                id,
+                stream,
+                data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
+                eof: false,
+              });
+            }
           });
           res.on("end", () => {
             proxyHttpReqs.delete(id);
-            sendProcessedProxyHttp(
-              id,
-              ctx,
-              status,
-              outHeaders,
-              Buffer.concat(chunks)
-            );
-          });
-          return;
-        }
-        bridgeSend({
-          type: "proxy.http.start",
-          id,
-          stream,
-          status,
-          headers: outHeaders,
-        });
-        res.on("data", (chunk) => {
-          const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-          for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
-            const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
             bridgeSend({
               type: "proxy.http.chunk",
               id,
               stream,
-              data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
-              eof: false,
+              data: "",
+              eof: true,
             });
-          }
-        });
-        res.on("end", () => {
-          proxyHttpReqs.delete(id);
-          bridgeSend({ type: "proxy.http.chunk", id, stream, data: "", eof: true });
-        });
+          });
+        }
+      );
+    } catch (err) {
+      if (hostIndex + 1 < hosts.length) {
+        hostIndex += 1;
+        connect();
+        return;
       }
-    );
-  } catch (err) {
-    bridgeSend({
-      type: "proxy.http.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
-    });
-    return;
-  }
-  req.on("error", (err) => {
-    proxyHttpReqs.delete(id);
-    bridgeSend({
-      type: "proxy.http.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
+      bridgeSend({
+        type: "proxy.http.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return;
+    }
+    req.on("error", (err) => {
+      if (isLoopbackConnError(err) && hostIndex + 1 < hosts.length) {
+        proxyHttpReqs.delete(id);
+        hostIndex += 1;
+        connect();
+        return;
+      }
+      proxyHttpReqs.delete(id);
+      bridgeSend({
+        type: "proxy.http.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
     });
-  });
-  proxyHttpReqs.set(id, req);
-  if (typeof msg.body === "string" && msg.body) {
-    req.write(Buffer.from(msg.body, "base64"));
-  }
-  if (msg.bodyEof !== false) req.end();
+    proxyHttpReqs.set(id, req);
+    if (initialBody?.length) req.write(initialBody);
+    if (endAfter) req.end();
+  };
+  connect();
 }
 
 function handleProxyHttpBodyFromAdmin(msg) {
@@ -2659,9 +2501,11 @@ function attachProxyLocalWs(id, socket) {
     /* WHATWG WebSocket in Node 22 */
   }
   proxyLocalSockets.set(id, socket);
-  socket.addEventListener("open", () => {
+  const announceOpen = () => {
     bridgeSend({ type: "proxy.ws.opened", id });
-  });
+  };
+  if (socket.readyState === 1) announceOpen();
+  else socket.addEventListener("open", announceOpen);
   socket.addEventListener("message", (event) => {
     try {
       if (typeof event.data === "string") {
@@ -2713,23 +2557,51 @@ function wsProtocolsFromMsg(msg) {
 }
 
 function openProxyLocalWs(id, port, path, protocols) {
-  let socket;
-  try {
-    const url = `ws://127.0.0.1:${port}${path}`;
-    const proto = Array.isArray(protocols)
-      ? protocols.map((p) => String(p || "").trim()).filter(Boolean)
-      : [];
-    // Vite HMR only accepts upgrades with subprotocol `vite-hmr` / `vite-ping`.
-    socket = proto.length ? new WebSocket(url, proto) : new WebSocket(url);
-  } catch (err) {
-    bridgeSend({
-      type: "proxy.ws.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
+  const proto = Array.isArray(protocols)
+    ? protocols.map((p) => String(p || "").trim()).filter(Boolean)
+    : [];
+  const hosts = loopbackHostsForPort(port);
+  const tryHost = (index) => {
+    const host = hosts[index];
+    const url = `ws://${host}:${port}${path}`;
+    let socket;
+    try {
+      // Vite HMR only accepts upgrades with subprotocol `vite-hmr` / `vite-ping`.
+      socket = proto.length ? new WebSocket(url, proto) : new WebSocket(url);
+    } catch (err) {
+      if (index + 1 < hosts.length) {
+        tryHost(index + 1);
+        return;
+      }
+      bridgeSend({
+        type: "proxy.ws.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return;
+    }
+    let settled = false;
+    socket.addEventListener("open", () => {
+      if (settled) return;
+      settled = true;
+      rememberLoopbackHost(port, host);
+      attachProxyLocalWs(id, socket);
     });
-    return;
-  }
-  attachProxyLocalWs(id, socket);
+    socket.addEventListener("close", () => {
+      if (settled) return;
+      settled = true;
+      if (index + 1 < hosts.length) {
+        tryHost(index + 1);
+        return;
+      }
+      bridgeSend({
+        type: "proxy.ws.error",
+        id,
+        error: `Cannot reach ${url}`,
+      });
+    });
+  };
+  tryHost(0);
 }
 
 function handleProxyWsOpenFromAdmin(msg) {
@@ -2865,7 +2737,6 @@ async function forgetLaunch(sandboxId) {
     if (key.startsWith(`${sandboxId}::`)) processProblems.delete(key);
   }
   await closeRememberedTerminals(sandboxId);
-  await stopCloudflare(sandboxId);
 }
 
 function problemKey(sandboxId, code, role = "") {
@@ -3254,15 +3125,10 @@ async function ensureEmbeddedChat(ws) {
   if (inflight) return inflight;
   const task = (async () => {
     const cfg = bridgeCfg || loadConfig();
-    const jobs = jobsFromHostApps(ws);
-    const shareEnv = {
-      ...envForWorkspacePorts(ws, jobs),
-      ...uiPublicEnv({}, ws),
-    };
     log(`lazy-start in-process chat for ${ws.sandboxName || shortId(ws.sandboxId)}`);
     const result = await startAiServerForWorkspace(ws, {
       cfg,
-      env: shareEnv,
+      env: chatLaunchEnv(ws, cfg),
       forceEmbed: true,
     });
     if (!result.up) return null;
@@ -3343,14 +3209,6 @@ async function startAiServerForWorkspace(ws, opts = {}) {
   const localAi = `http://localhost:${port}`;
   const overrideEnv =
     opts.env && typeof opts.env === "object" ? opts.env : {};
-  const publicAi =
-    (typeof overrideEnv.AI_SERVER_URL === "string" &&
-      overrideEnv.AI_SERVER_URL.trim()) ||
-    (typeof overrideEnv.NEXT_PUBLIC_AI_SERVER_URL === "string" &&
-      overrideEnv.NEXT_PUBLIC_AI_SERVER_URL.trim()) ||
-    (typeof ws.cloudflare?.ai === "string" && ws.cloudflare.ai.trim()) ||
-    "";
-  const aiUrl = publicAi || localAi;
   persistWorkspaceEntry(cfg, ws);
 
   const storeEnv = await loadSandboxStoreEnv(ws, cfg);
@@ -3360,7 +3218,7 @@ async function startAiServerForWorkspace(ws, opts = {}) {
     ...folderEnv,
     ...overrideEnv,
     ...storeEnv,
-    AI_SERVER_URL: aiUrl,
+    AI_SERVER_URL: localAi,
     CORS_ORIGIN: overrideEnv.CORS_ORIGIN || folderEnv.CORS_ORIGIN || "",
     CORS_ORIGINS: overrideEnv.CORS_ORIGINS || folderEnv.CORS_ORIGINS || "",
     MAINTAINER_PRO_DATA_DIR: dataDir,
@@ -3403,37 +3261,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function stopAllCloudflare() {
-  for (const id of [...cloudflareTunnels.keys()]) stopCloudflare(id);
-}
-
-function killProcessesByCommand(fragment) {
-  if (!fragment) return Promise.resolve();
-  return new Promise((resolve) => {
-    const done = () => resolve();
-    if (process.platform === "win32") {
-      const escaped = String(fragment).replace(/'/g, "''");
-      const child = spawn(
-        "powershell.exe",
-        [
-          "-NoProfile",
-          "-Command",
-          `Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*${escaped}*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }`,
-        ],
-        { windowsHide: true, stdio: "ignore" }
-      );
-      child.on("exit", done);
-      child.on("error", done);
-      setTimeout(done, 8000);
-      return;
-    }
-    const child = spawn("pkill", ["-f", String(fragment)], { stdio: "ignore" });
-    child.on("exit", done);
-    child.on("error", done);
-    setTimeout(done, 4000);
-  });
-}
-
 function killPort(port) {
   const n = Number(port);
   if (!n) return Promise.resolve();
@@ -3465,29 +3292,6 @@ function killPort(port) {
   });
 }
 
-function stopCloudflare(sandboxId, folder) {
-  const row = cloudflareTunnels.get(sandboxId);
-  const files = new Set(
-    (row?.tunnels?.map((t) => t.logFile).filter(Boolean) ?? [])
-  );
-  cloudflareTunnels.delete(sandboxId);
-  const logDir = folder
-    ? dataDirFor(folder, sandboxId)
-    : null;
-  if (logDir && fs.existsSync(logDir)) {
-    try {
-      for (const name of fs.readdirSync(logDir)) {
-        if (/^cf-.*\.log$/i.test(name) && !name.endsWith(".stale")) {
-          files.add(path.join(logDir, name));
-        }
-      }
-    } catch {
-      /* ignore */
-    }
-  }
-  return Promise.all([...files].map((file) => killProcessesByCommand(file)));
-}
-
 function forgetProcessLaunches(sandboxId) {
   for (const key of [...launchedAt.keys()]) {
     if (key === sandboxId || key.startsWith(`${sandboxId}:`)) {
@@ -3545,231 +3349,6 @@ async function waitUntilReachable(url, timeoutMs, label, onWait) {
   throw new Error(`${label} did not become reachable at ${url}`);
 }
 
-function applyBackendPublicEnv(env, url) {
-  const backend = String(url || "").replace(/\/$/, "");
-  if (!backend) return env;
-  env.API_URL = backend;
-  env.API_BASE_URL = backend;
-  env.BACKEND_URL = backend;
-  env.VITE_API_URL = backend;
-  env.VITE_API_BASE_URL = backend;
-  env.NEXT_PUBLIC_API_URL = backend;
-  env.NEXT_PUBLIC_API_BASE_URL = backend;
-  env.REACT_APP_API_URL = backend;
-  return env;
-}
-
-function uiPublicEnv(tunnels, ws) {
-  /** @type {Record<string, string>} */
-  const env = {};
-  const aiApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
-    (app) => app.role === "ai-server" || app.id === "ai-server"
-  ) || { id: "ai-server", role: "ai-server" };
-  const ai =
-    proxyUrlForApp(ws, aiApp) ||
-    (tunnels.ai ? String(tunnels.ai).replace(/\/$/, "") : "");
-  if (ai) {
-    env.AI_SERVER_URL = ai;
-    env.NEXT_PUBLIC_AI_SERVER_URL = ai;
-    env.VITE_AI_SERVER_URL = ai;
-    env.REACT_APP_AI_SERVER_URL = ai;
-  }
-  const backendApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
-    (app) => isBackendApp(app)
-  );
-  const backendUrl =
-    (backendApp ? proxyUrlForApp(ws, backendApp) : "") ||
-    (typeof tunnels.backend === "string" && tunnels.backend) ||
-    (backendApp ? publicUrlForApp(ws, backendApp) : "") ||
-    "";
-  if (backendUrl && backendApp) {
-    applyBackendPublicEnv(env, backendUrl);
-  }
-  if (tunnels.ui) {
-    const ui = String(tunnels.ui).replace(/\/$/, "");
-    env.APP_URL = ui;
-    env.PUBLIC_URL = ui;
-    env.CORS_ORIGIN = ui;
-    env.NEXT_PUBLIC_APP_URL = ui;
-    env.VITE_APP_URL = ui;
-    env.REACT_APP_APP_URL = ui;
-  } else if (tunnels.app) {
-    const app = String(tunnels.app).replace(/\/$/, "");
-    env.APP_URL = app;
-    env.PUBLIC_URL = app;
-    env.CORS_ORIGIN = app;
-    env.NEXT_PUBLIC_APP_URL = app;
-    env.VITE_APP_URL = app;
-    env.REACT_APP_APP_URL = app;
-  } else if (ai) {
-    const hostUi = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).some(
-      (app) => app.host || app.role === "ui" || app.role === "app"
-    );
-    if (!hostUi) {
-      env.CORS_ORIGIN = ai;
-      env.APP_URL = ai;
-      env.PUBLIC_URL = ai;
-      env.NEXT_PUBLIC_APP_URL = ai;
-      env.VITE_APP_URL = ai;
-    }
-  }
-  return env;
-}
-
-function publicUrlForApp(ws, app) {
-  if (!app) return "";
-  const proxied = proxyUrlForApp(ws, app);
-  if (proxied) return proxied;
-  const port = Number(app.port) || 0;
-  return port ? `http://localhost:${port}` : "";
-}
-
-function envFromConfiguredMaps(ws) {
-  /** @type {Record<string, string>} */
-  const env = {};
-  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
-  for (const app of apps) {
-    const maps = Array.isArray(app.envMaps) ? app.envMaps : [];
-    for (const row of maps) {
-      const key = String(row?.key || "").trim();
-      const sourceId = String(row?.sourceAppId || "").trim();
-      if (!key || !sourceId) continue;
-      const source =
-        sourceId === "self"
-          ? app
-          : apps.find((item) => item.id === sourceId) || null;
-      const url = publicUrlForApp(ws, source);
-      if (url) env[key] = url;
-    }
-  }
-  return env;
-}
-
-function cloudflarePublicEnv(ws) {
-  const tunnels =
-    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
-  const jobs = jobsFromHostApps(ws);
-  const env = {
-    ...envForWorkspacePorts(ws, jobs),
-    ...uiPublicEnv(tunnels, ws),
-  };
-  const origins = [];
-  const add = (value) => {
-    const origin = originFromUrl(value);
-    if (origin && !origins.includes(origin)) origins.push(origin);
-  };
-  add(tunnels.ui);
-  add(tunnels.app);
-  add(tunnels.backend);
-  add(tunnels.ai);
-  add(env.APP_URL);
-  add(env.CORS_ORIGIN);
-  for (const job of jobs) {
-    if (job.port) add(`http://localhost:${job.port}`);
-  }
-  add(`http://localhost:${Number(ws.port) || 3100}`);
-  if (origins.length) {
-    env.CORS_ORIGIN = origins.join(",");
-    env.CORS_ORIGINS = origins.join(",");
-  }
-  Object.assign(env, envFromConfiguredMaps(ws));
-  return env;
-}
-
-async function applyPublicUrlsToRunningApps(ws, cfg, opts = {}) {
-  const folder = ws.folderPath ? path.resolve(ws.folderPath) : "";
-  const progress =
-    typeof opts.onProgress === "function" ? opts.onProgress : async () => {};
-  const tunnels =
-    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
-  const hasProxy = Boolean(ws.proxy?.token);
-  if (
-    !folder ||
-    !fs.existsSync(folder) ||
-    (!Object.keys(tunnels).length && !hasProxy)
-  ) {
-    return { restarted: [], rewritten: [] };
-  }
-  const env = {
-    ...cloudflarePublicEnv(ws),
-  };
-  if (Object.keys(tunnels).length) writeTunnelEnv(ws, tunnels);
-  const mappedKeys = Object.keys(envFromConfiguredMaps(ws));
-  if (mappedKeys.length) {
-    activity(
-      ws.sandboxId,
-      "info",
-      `Injecting public URLs into process env for ${mappedKeys.join(", ")}`
-    );
-    await progress(`Passing ${mappedKeys.join(", ")} via process env`);
-  }
-
-  const probe = await probeRunningApps(ws, 1200);
-  const runningRoles = new Set(
-    (probe.hostApps || [])
-      .filter((app) => app.running)
-      .map((app) =>
-        app.role === "ai-server" ? "ai-server" : app.role === "custom" ? "app" : app.role
-      )
-  );
-  const reserved = reservedPortsFor(cfg, ws.sandboxId);
-  const restarted = [];
-
-  if (probe.chatUp || runningRoles.has("ai-server") || embeddedChat.has(ws.sandboxId)) {
-    await progress("Restarting in-process chat with public URLs and CORS…");
-    launchedAt.delete(`${ws.sandboxId}:${folder}:ai`);
-    await stopEmbeddedChat(ws.sandboxId);
-    await startAiServerForWorkspace(ws, {
-      reserved,
-      cfg,
-      port: ws.port,
-      env,
-    });
-    restarted.push("ai-server");
-  }
-
-  const jobs = jobsFromHostApps(ws).filter((job) =>
-    runningRoles.has(job.role === "custom" ? "app" : job.role)
-  );
-  if (jobs.length) {
-    const roles = [...new Set(jobs.map((job) => job.role))];
-    await progress(
-      `Restarting ${roles.join(", ")} so they load the public URLs…`
-    );
-    for (const job of jobs) {
-      launchedAt.delete(`${ws.sandboxId}:${folder}:${job.script}`);
-      await killPort(job.port);
-    }
-    await sleep(1500);
-    await ensureHostProcesses(ws, {
-      reserved,
-      cfg,
-      onlyRoles: roles,
-      extraEnv: env,
-      force: true,
-      plannedJobs: jobsFromHostApps(ws),
-    });
-    restarted.push(...roles);
-  }
-
-  if (restarted.length) {
-    activity(
-      ws.sandboxId,
-      "info",
-      `Restarted ${[...new Set(restarted)].join(", ")} with public URLs`
-    );
-  }
-  return { restarted: [...new Set(restarted)], rewritten: [], env };
-}
-
-function writeTunnelEnv(ws, tunnels) {
-  const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
-  if (!folder || !fs.existsSync(folder)) return { ok: false, env: {} };
-  clearCloudflareTunnelFile(folder);
-  const env = uiPublicEnv(tunnels, ws);
-  return { ok: true, env };
-}
-
 function reservedPortsFor(cfg, sandboxId) {
   const reserved = new Set();
   for (const other of cfg.workspaces || []) {
@@ -3784,17 +3363,12 @@ function appsWanted(ws) {
   return Boolean(ws?.appsRequested);
 }
 
-async function configureCloudflareForWorkspace(ws, cfg, opts = {}) {
+async function configureShareForWorkspace(ws, cfg, opts = {}) {
   const sandboxId = ws.sandboxId;
   const progress = (message) =>
     reportActionProgress(cfg, opts.actionId, message);
-  await progress("Using Maintainer Pro share URLs (no Cloudflare).");
-  try {
-    await stopCloudflare(sandboxId, ws.folderPath);
-  } catch {
-    /* leftover tunnels */
-  }
-  ws.cloudflarePending = false;
+  await progress("Using Maintainer Pro share URLs.");
+  stripDiscardedTunnelState(ws, cfg);
   persistWorkspaceEntry(cfg, ws);
   const status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
@@ -3808,12 +3382,10 @@ async function configureCloudflareForWorkspace(ws, cfg, opts = {}) {
     folderPath: ws.folderPath,
     port: ws.port,
     pending: false,
-    cloudflarePending: false,
     waitingForStart: false,
     appUrl: status.host.appUrl || share,
     origins: status.host.origins,
     publicUrl: share || null,
-    cloudflare: false,
   };
 }
 
@@ -3825,12 +3397,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
     `Checking running apps for ${label}…`
   );
 
-  try {
-    await stopCloudflare(ws.sandboxId, ws.folderPath);
-  } catch {
-    /* leftover cloudflared */
-  }
-  ws.cloudflarePending = false;
+  stripDiscardedTunnelState(ws, cfg);
 
   let status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
@@ -3858,11 +3425,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
     timeoutMs: 800,
   });
 
-  const shareEnv = {
-    ...envForWorkspacePorts(ws, plan.jobs),
-    ...uiPublicEnv({}, ws),
-    ...envFromConfiguredMaps(ws),
-  };
+  const chatEnv = chatLaunchEnv(ws, cfg);
 
   if (!cfg.noAiServer) {
     if (status.probe.chatUp) {
@@ -3875,7 +3438,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
         reserved,
         cfg,
         port: plan.aiPort,
-        env: shareEnv,
+        env: chatEnv,
       });
       await sleep(1500);
     }
@@ -3890,14 +3453,9 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
       const probed = status.probe.hosts.find((h) => h.role === job.role);
       return probed?.up ? { ...job, up: true, port: probed.port } : job;
     }),
-    extraEnv: shareEnv,
   });
   await sleep(800);
 
-  await applyPublicUrlsToRunningApps(ws, cfg, {
-    onProgress: (message) => reportActionProgress(cfg, opts.actionId, message),
-  });
-
   status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
   });
@@ -3929,7 +3487,6 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
         ws,
         hostAppOf(ws) || { id: "ui", role: "ui", host: true }
       ) || null,
-    cloudflare: false,
     hostApps: status.probe.hostApps || ws.hostApps || [],
     processIssues,
     warning,
@@ -3975,9 +3532,6 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
   await progress(`Starting ${app.name} on port ${app.port}…`);
   ws.appsRequested = true;
   persistWorkspaceEntry(cfg, ws);
-  const publicEnv = {
-    ...cloudflarePublicEnv(ws),
-  };
   if (app.role === "ai-server") {
     const reserved = reservedPortsFor(cfg, ws.sandboxId);
     const chat = await discoverChatPort(ws, 1200);
@@ -3989,7 +3543,7 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
         reserved,
         cfg,
         port: Number(app.port) || ws.port || 3100,
-        env: publicEnv,
+        env: chatLaunchEnv(ws, cfg),
       });
     }
   } else {
@@ -3998,7 +3552,6 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
       reserved,
       cfg,
       onlyRoles: [app.role === "custom" ? "app" : app.role],
-      extraEnv: publicEnv,
       force: true,
       plannedJobs: jobsFromHostApps(ws),
     });
@@ -4068,7 +3621,7 @@ async function restartSingleApp(ws, cfg, payload = {}, opts = {}) {
   return startSingleApp(ws, cfg, payload, opts);
 }
 
-async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
+async function startShareForApp(ws, cfg, payload = {}, opts = {}) {
   const app = findHostApp(ws, payload);
   if (!app) {
     activity(ws.sandboxId, "error", "Share URL failed: unknown app/port");
@@ -4086,9 +3639,6 @@ async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
     await progress(`Using the Maintainer Pro share URL for ${app.name}…`);
     const started = await startSingleApp(ws, cfg, { appId: app.id }, opts);
     if (started.error) return started;
-    const applied = await applyPublicUrlsToRunningApps(ws, cfg, {
-      onProgress: progress,
-    });
     const status = await reconcileWorkspacePresence(ws, cfg, {
       timeoutMs: 2500,
     });
@@ -4098,12 +3648,9 @@ async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
       running: Boolean(started.running),
       port: started.port,
       publicUrl: shareUrl,
-      cloudflareUrl: null,
       appUrl: status.host.appUrl,
       origins: status.host.origins,
       hostApps: status.probe.hostApps || [],
-      rewritten: applied.rewritten,
-      restarted: applied.restarted,
       log: activityLogFor(ws.sandboxId),
     };
   }
@@ -4158,12 +3705,10 @@ async function ensureHostProcesses(ws, opts = {}) {
   for (const job of jobs) {
     if (onlyRoles && !onlyRoles.has(job.role)) continue;
     const preferred = Number(job.port || job.preferredPort) || 3000;
-    const probe = (
-      job.port
-        ? `http://127.0.0.1:${job.port}`
-        : job.probeUrl || `http://127.0.0.1:${preferred}`
-    ).replace("localhost", "127.0.0.1");
-    if (job.up || (await probeUrl(probe))) {
+    const probe = job.port
+      ? `http://127.0.0.1:${job.port}`
+      : job.probeUrl || `http://127.0.0.1:${preferred}`;
+    if (job.up || (await probeLoopbackUrl(probe))) {
       reserved.add(portFromText(probe, preferred));
       clearProcessProblem(ws.sandboxId, "host_process_launch", job.role);
       clearProcessProblem(ws.sandboxId, "host_process_down", job.role);
@@ -4265,11 +3810,8 @@ async function inspectHostJobs(ws) {
   const hosts = [];
   for (const job of jobs) {
     const preferred = Number(job.preferredPort) || 3000;
-    const probe = (job.probeUrl || `http://127.0.0.1:${preferred}`).replace(
-      "localhost",
-      "127.0.0.1"
-    );
-    const up = await probeUrl(probe);
+    const probe = job.probeUrl || `http://127.0.0.1:${preferred}`;
+    const up = await probeLoopbackUrl(probe);
     const launchKey = `${ws.sandboxId}:${folder}:${job.script}`;
     const starting = recentlyLaunched(launchKey);
     hosts.push({
@@ -4391,7 +3933,6 @@ async function setupWorkspace(cfg, action) {
     appUrl,
     sameOrigin: Boolean(client.sameOrigin),
     appsRequested: false,
-    cloudflarePending: false,
     store: {
       serverKey: String(config.env?.MAINTAINER_PRO_API_KEY || "").trim(),
       clientKey: String(
@@ -4497,8 +4038,7 @@ async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
     const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
     const apps = (proposal.apps || []).map((app) => {
       const match = previous.find((row) => row && row.id === app.id);
-      if (!match || (app.envMaps && app.envMaps.length)) return app;
-      return { ...app, envMaps: match.envMaps || [] };
+      return match ? { ...app, host: match.host === true || app.host === true } : app;
     });
     // Keep last known apps on the workspace; do not auto-apply proposal.
     if (!Array.isArray(ws.hostApps) || !ws.hostApps.length) {
@@ -4565,6 +4105,7 @@ async function runActions(cfg, actions) {
   if (!actions.length) return;
   log(`actions received ${actions.length}: ${actions.map((a) => a.code).join(", ")}`);
   for (const action of actions) {
+    action.code = canonicalActionCode(action.code);
     const startedAt = Date.now();
     const label = actionLabel(action);
     log(`${label} start`);
@@ -4693,14 +4234,14 @@ async function runActions(cfg, actions) {
           });
           if (result.error) ok = false;
         }
-      } else if (action.code === "start_cloudflare_app") {
+      } else if (action.code === "start_share_app") {
         const sandboxId = action.sandboxId || action.payload?.sandboxId;
         const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
         if (!ws) {
           ok = false;
           result = { error: "No folder is attached for this sandbox" };
         } else {
-          result = await startCloudflareForApp(ws, cfg, action.payload || {}, {
+          result = await startShareForApp(ws, cfg, action.payload || {}, {
             actionId: action.id,
           });
           if (result.error) ok = false;
@@ -4805,7 +4346,6 @@ async function runActions(cfg, actions) {
           sandboxId: sandboxId || ws?.sandboxId || null,
           appUrl:
             host.appUrl ||
-            ws?.cloudflareUrl ||
             ws?.appUrl ||
             process.env.APP_URL ||
             process.env.PUBLIC_URL ||
@@ -4817,7 +4357,7 @@ async function runActions(cfg, actions) {
             host.origins.join(",") || "none"
           }`
         );
-      } else if (action.code === "configure_cloudflare") {
+      } else if (action.code === "configure_share") {
         const sandboxId = action.sandboxId || action.payload?.sandboxId;
         const ws =
           (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId) ||
@@ -4838,7 +4378,7 @@ async function runActions(cfg, actions) {
           result = { error: "No folder is attached for this sandbox" };
           warn(`${label} skipped: ${result.error}`);
         } else {
-          result = await configureCloudflareForWorkspace(ws, cfg, {
+          result = await configureShareForWorkspace(ws, cfg, {
             actionId: action.id,
           });
         }
@@ -5643,7 +5183,6 @@ async function main() {
       clearInterval(watchdogTimer);
       watchdogTimer = null;
     }
-    stopAllCloudflare();
     dropSocket(socket);
     socket = null;
     log("shutting down (other terminals stay open)");