@mycadet/cli 0.12.7 → 0.12.8

package/src/commands/terminal.ts

@@ -1,9 +1,10 @@
 /**
- * `cadet terminal` — Interactive shell into a managed assistant container.
+ * `cadet terminal` — Interactive shell into an assistant.
  *
- * Bridges the local tty to a platform terminal session (K8s exec) so the
- * user can interact with their assistant's sandbox from iTerm2 or any
- * local terminal emulator.
+ * Dispatches by cloud type: a cloud terminal session (K8s exec) for
+ * cloud assistants, `docker exec` for docker assistants, `gcloud compute
+ * ssh` for GCP, raw ssh for custom hosts, and the container management
+ * socket for apple-container assistants.
  *
  * Subcommands:
  *   cadet terminal                     — Interactive shell
@@ -11,6 +12,13 @@
  *   cadet terminal list                — List tmux sessions
  */
 
+import { isCloudHome } from "../lib/cloud-values.js";
+import { spawn } from "child_process";
+
+import { extractHostFromUrl, resolveAssistant } from "../lib/assistant-config";
+import { dockerResourceNames } from "../lib/docker";
+import { getCloudUrl, readCloudToken } from "../lib/cloud-client";
+import { sshAppleContainer } from "../lib/ssh-apple-container";
 import {
   closeTerminalSession,
   createTerminalSession,
@@ -22,6 +30,18 @@ import {
   resolveManagedAssistant,
 } from "../lib/terminal-session.js";
 import type { ResolvedManagedAssistant } from "../lib/terminal-session.js";
+import type { ChildProcess } from "child_process";
+
+const SSH_OPTS = [
+  "-o",
+  "StrictHostKeyChecking=no",
+  "-o",
+  "UserKnownHostsFile=/dev/null",
+  "-o",
+  "ConnectTimeout=10",
+  "-o",
+  "LogLevel=ERROR",
+];
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -30,9 +50,15 @@ import type { ResolvedManagedAssistant } from "../lib/terminal-session.js";
 function printHelp(): void {
   console.log("Usage: cadet terminal [subcommand] [options]");
   console.log("");
+  console.log("Open an interactive terminal session into an assistant.");
+  console.log("");
   console.log(
-    "Open an interactive terminal session into a managed assistant container.",
+    "Managed (cloud-hosted) assistants get a cloud terminal session; docker",
   );
+  console.log(
+    "assistants shell in via docker exec, GCP assistants via gcloud, custom",
+  );
+  console.log("hosts via ssh, and apple-container assistants via their management socket.");
   console.log("");
   console.log("Subcommands:");
   console.log("  (none)              Interactive shell");
@@ -58,6 +84,19 @@ function printHelp(): void {
   console.log("  cadet terminal --assistant my-assistant");
 }
 
+function waitForExit(child: ChildProcess): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`terminal exited with code ${code}`));
+      }
+    });
+    child.on("error", reject);
+  });
+}
+
 // ---------------------------------------------------------------------------
 // List tmux sessions
 // ---------------------------------------------------------------------------
@@ -73,7 +112,7 @@ async function listTmuxSessions(
     assistant.assistantId,
     cols,
     rows,
-    assistant.platformUrl,
+    assistant.cloudUrl,
   );
 
   const abortController = new AbortController();
@@ -88,7 +127,7 @@ async function listTmuxSessions(
         assistant.token,
         assistant.assistantId,
         sessionId,
-        assistant.platformUrl,
+        assistant.cloudUrl,
         abortController.signal,
       )) {
         const text = Buffer.from(event.data, "base64").toString("utf-8");
@@ -108,7 +147,7 @@ async function listTmuxSessions(
               assistant.assistantId,
               sessionId,
               'tmux list-sessions 2>/dev/null || echo "No tmux sessions found"; exit\r',
-              assistant.platformUrl,
+              assistant.cloudUrl,
             );
           }
         }
@@ -125,7 +164,7 @@ async function listTmuxSessions(
       assistant.token,
       assistant.assistantId,
       sessionId,
-      assistant.platformUrl,
+      assistant.cloudUrl,
     ).catch(() => {});
   }
 
@@ -200,10 +239,9 @@ export const terminal = Object.assign(
     }
   }
 
-  const assistant = resolveManagedAssistant(assistantName);
-
+  // tmux subcommands are managed-cloud features
   if (subcommand === "list") {
-    await listTmuxSessions(assistant);
+    await listTmuxSessions(resolveManagedAssistant(assistantName));
     return;
   }
 
@@ -217,13 +255,115 @@ export const terminal = Object.assign(
     }
     // Shell-escape the session name to handle spaces/metacharacters
     const escaped = tmuxSessionName.replace(/'/g, "'\\''");
-    await interactiveSession(assistant, `tmux attach -t '${escaped}'`);
+    await interactiveSession(
+      resolveManagedAssistant(assistantName),
+      `tmux attach -t '${escaped}'`,
+    );
+    return;
+  }
+
+  // Default: interactive shell, dispatched by the assistant's cloud type.
+  const entry = resolveAssistant(assistantName);
+
+  if (!entry) {
+    if (assistantName) {
+      console.error(`No assistant instance found with name '${assistantName}'.`);
+    } else {
+      console.error("No assistant instance found. Run `cadet hatch` first.");
+    }
+    process.exit(1);
+  }
+
+  const cloud = entry.cloud;
+
+  if (cloud === "local") {
+    console.error(
+      "Cannot open a terminal into a local assistant. Local assistants run directly on this machine.\n" +
+        `Use 'cadet ps ${entry.assistantId}' to check its processes instead.`,
+    );
+    process.exit(1);
+  }
+
+  if (cloud === "aws") {
+    console.error("Terminals on AWS instances are not yet supported.");
+    process.exit(1);
+  }
+
+  // Apple container: connect to the management socket for an interactive shell.
+  if (cloud === "apple-container") {
+    await sshAppleContainer(entry);
     return;
   }
 
-  // Default: interactive shell
-  await interactiveSession(assistant);
+  if (cloud === "docker") {
+    const res = dockerResourceNames(entry.assistantId);
+    console.log(`🔗 Connecting to ${entry.assistantId} via docker exec...\n`);
+
+    const child = spawn(
+      "docker",
+      ["exec", "-it", res.assistantContainer, "/bin/sh"],
+      { stdio: "inherit", windowsHide: true },
+    );
+    await waitForExit(child);
+    return;
+  }
+
+  if (cloud === "gcp") {
+    const project = entry.project;
+    const zone = entry.zone;
+    if (!project || !zone) {
+      console.error("Error: GCP project and zone not found in assistant config.");
+      process.exit(1);
+    }
+
+    const sshTarget = entry.sshUser
+      ? `${entry.sshUser}@${entry.assistantId}`
+      : entry.assistantId;
+
+    console.log(`🔗 Connecting to ${entry.assistantId} via gcloud...\n`);
+
+    const child = spawn(
+      "gcloud",
+      ["compute", "ssh", sshTarget, `--project=${project}`, `--zone=${zone}`],
+      { stdio: "inherit", windowsHide: true },
+    );
+    await waitForExit(child);
+    return;
+  }
+
+  if (isCloudHome(cloud)) {
+    const token = readCloudToken();
+    if (!token) {
+      console.error(
+        "Not logged in. Run `cadet login` first to authenticate with Cadet Cloud.",
+      );
+      process.exit(1);
+    }
+    await interactiveSession({
+      assistantId: entry.assistantId,
+      token,
+      cloudUrl: getCloudUrl(),
+    });
+    return;
+  }
+
+  if (cloud === "custom") {
+    const host = extractHostFromUrl(entry.runtimeUrl);
+    const sshUser = entry.sshUser ?? "root";
+    const sshTarget = `${sshUser}@${host}`;
+
+    console.log(`🔗 Connecting to ${entry.assistantId} via ssh...\n`);
+
+    const child = spawn("ssh", [...SSH_OPTS, sshTarget], {
+      stdio: "inherit",
+      windowsHide: true,
+    });
+    await waitForExit(child);
+    return;
+  }
+
+  console.error(`Error: Unknown cloud type '${cloud}'.`);
+  process.exit(1);
 },
-  { description: "Open a terminal into a managed assistant container" },
+  { description: "Open a terminal into an assistant" },
 );
-

package/src/commands/tunnel.ts

@@ -1,4 +1,4 @@
-import { isManagedCloud } from "../lib/managed-cloud.js";
+import { isCloudHome } from "../lib/cloud-values.js";
 import { readFileSync } from "node:fs";
 import { join } from "path";
 
@@ -14,41 +14,36 @@ import {
   type AssistantEntry,
 } from "../lib/assistant-config";
 import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
-import { runCloudflareTunnel } from "../lib/cloudflare-tunnel.js";
 import { relaunchDetached } from "../lib/detached-process.js";
 import {
   getDefaultWorkspaceDir,
   isLocalContainerEntry,
   parseGatewayPortFromEntryUrls,
-  saveNgrokDomain,
 } from "../lib/ingress-config.js";
 import {
   ensureTunnelEdge,
   formatEdgeMode,
   type TunnelEdge,
 } from "../lib/nginx-ingress.js";
-import { hasWebhookIntegrationsConfigured, runNgrokTunnel } from "../lib/ngrok";
-import { shellArg } from "../lib/shell-arg.js";
 import { STALE_CLI_UPDATE_HINT } from "../lib/stale-cli-hint.js";
-import { runTailscaleTunnel } from "../lib/tailscale-tunnel.js";
-
-// `cadet` is the managed option this command owns; the local providers come
-// from the shared registry so validation here cannot drift from what the
-// workspace config accepts.
-const VALID_PROVIDERS = ["cadet", ...TUNNEL_PROVIDERS] as const;
-type TunnelProvider = (typeof VALID_PROVIDERS)[number];
-
-// How far each provider's URL reaches, for the chooser a missing `--provider`
-// prints. Keyed off the registry so a new provider cannot ship unoffered.
-const PROVIDER_REACH: Record<TunnelProviderName, string> = {
-  ngrok: "Public tunnel that webhook integrations can reach",
-  cloudflare: "Public tunnel that webhook integrations can reach",
-  tailscale: "Tailnet-only tunnel, reachable from your own devices",
-};
+import {
+  ADOPTED_TUNNEL_RE,
+  DEFAULT_TUNNEL_PROVIDER,
+  PROVIDER_META,
+  adoptedTunnelStopNotice,
+  cadetTunnelComingSoonError,
+  clearReservedDomain,
+  hasWebhookIntegrationsConfigured,
+  providerSupportsReservedDomain,
+  runProviderTunnel,
+} from "../lib/tunnel.js";
+
+// The accepted `--provider` values ARE the shared registry, so validation
+// here cannot drift from what the workspace config accepts.
 
 interface TunnelArgs {
   assistantName: string | null;
-  provider: TunnelProvider;
+  provider: TunnelProviderName;
   domain: string | null;
   clearDomain: boolean;
   detach: boolean;
@@ -58,7 +53,7 @@ const FLAGS_WITH_VALUES = ["--provider", "--domain"] as const;
 
 function parseArgs(): TunnelArgs {
   const args = process.argv.slice(3);
-  let provider: TunnelProvider | null = null;
+  let provider: TunnelProviderName | null = null;
   let domain: string | null = null;
   let clearDomain = false;
   let detach = false;
@@ -76,14 +71,13 @@ function parseArgs(): TunnelArgs {
       );
       console.log("");
       console.log(
-        "How far that URL reaches depends on the provider, so --provider is required.",
-      );
-      console.log(
-        "A tailscale tunnel is reachable only from your own tailnet; webhook",
+        "How far that URL reaches depends on the provider; omit --provider for",
       );
+      console.log("the default. A tailscale tunnel is reachable only from your");
       console.log(
-        "integrations need a public tunnel: --provider ngrok or --provider cloudflare.",
+        "own tailnet; webhook integrations need a public tunnel (see Providers",
       );
+      console.log("below).");
       console.log("");
       console.log(
         "The tunnel always fronts the local nginx edge, which is started automatically.",
@@ -99,19 +93,21 @@ function parseArgs(): TunnelArgs {
       console.log("");
       console.log("Options:");
       console.log(
-        `  --provider <provider>         Required. Tunnel provider: ${VALID_PROVIDERS.join(", ")}`,
+        `  --provider <provider>         Tunnel provider: ${TUNNEL_PROVIDERS.join(", ")}`,
       );
+      console.log(`                                (default: ${DEFAULT_TUNNEL_PROVIDER})`);
       console.log(
-        "  --domain <domain>             Reserved ngrok domain to bind (ngrok provider only).",
+        "  --domain <domain>             Reserved domain to bind, for providers that support",
       );
       console.log(
-        "                                Saved to the workspace config so `cadet wake` restores reuse it.",
+        "                                one. Saved to the workspace config so `cadet wake` restores",
       );
+      console.log("                                reuse it.");
       console.log(
-        "  --clear-domain                Clear the saved ngrok domain (ngrok provider only) and tunnel",
+        "  --clear-domain                Clear the saved reserved domain (same providers) and",
       );
       console.log(
-        "                                without one. Cannot be combined with --domain.",
+        "                                tunnel without one. Cannot be combined with --domain.",
       );
       console.log(
         `  -d, --detach                  Run the tunnel in the background. Waits up to ${TUNNEL_BACKGROUND_START_TIMEOUT_MS / 1000}s for the`,
@@ -123,72 +119,64 @@ function parseArgs(): TunnelArgs {
         "                                the CLI log directory. Stop it with `kill <pid>`, except when it",
       );
       console.log(
-        "                                adopted an already-running ngrok tunnel (started outside this",
+        "                                adopted an already-running tunnel (started outside this",
       );
       console.log(
         "                                command): killing the supervisor then leaves that tunnel running.",
       );
       console.log("");
       console.log("Providers:");
-      console.log(
-        "  cadet       Managed tunnel via Cadet Cloud (not yet available)",
-      );
-      console.log(
-        "  ngrok        ngrok tunnel — install: brew install ngrok/ngrok/ngrok",
-      );
-      console.log(
-        "  cloudflare   Cloudflare quick tunnel — install: brew install cloudflare/cloudflare/cloudflared",
-      );
-      console.log(
-        "               No Cloudflare account required for quick tunnels.",
-      );
-      console.log(
-        "  tailscale    Tailscale serve. Install: https://tailscale.com/download, then run `tailscale up`",
-      );
-      console.log(
-        "               Reachable only from your own tailnet (private; LetsEncrypt cert).",
-      );
-      console.log(
-        "               When webhook integrations are configured it records its URL for device",
-      );
-      console.log(
-        "               pairing only, leaving the saved webhook callback base as it is.",
-      );
+      for (const name of TUNNEL_PROVIDERS) {
+        const meta = PROVIDER_META[name];
+        console.log(`  ${name.padEnd(12)}${meta.reach}`);
+        console.log(`  ${" ".repeat(12)}${meta.install}`);
+        for (const note of meta.notes ?? []) {
+          console.log(`  ${" ".repeat(12)}${note}`);
+        }
+      }
       console.log("");
       console.log("Examples:");
-      console.log("  $ cadet tunnel --provider ngrok");
-      console.log(
-        "  $ cadet tunnel --provider ngrok --domain my-assistant.ngrok.app",
-      );
-      console.log("  $ cadet tunnel --provider ngrok --clear-domain");
+      console.log(`  $ cadet tunnel --provider ${DEFAULT_TUNNEL_PROVIDER}`);
+      const domainExample = PROVIDER_META[DEFAULT_TUNNEL_PROVIDER].domainExample;
+      if (domainExample) {
+        console.log(
+          `  $ cadet tunnel --provider ${DEFAULT_TUNNEL_PROVIDER} --domain ${domainExample}`,
+        );
+        console.log(
+          `  $ cadet tunnel --provider ${DEFAULT_TUNNEL_PROVIDER} --clear-domain`,
+        );
+      }
       console.log("  $ cadet tunnel --provider cloudflare");
       console.log("  $ cadet tunnel my-assistant --provider tailscale");
-      console.log("  $ cadet tunnel --provider ngrok --detach");
+      console.log(
+        `  $ cadet tunnel --provider ${DEFAULT_TUNNEL_PROVIDER} --detach`,
+      );
       process.exit(0);
     } else if (arg === "--provider") {
       const next = args[i + 1];
       if (!next || next.startsWith("-")) {
         console.error(
-          `Error: --provider requires one of: ${VALID_PROVIDERS.join(", ")}`,
+          `Error: --provider requires one of: ${TUNNEL_PROVIDERS.join(", ")}`,
         );
         process.exit(1);
       }
-      if (!VALID_PROVIDERS.includes(next as TunnelProvider)) {
+      if (!TUNNEL_PROVIDERS.includes(next as TunnelProviderName)) {
         console.error(
-          `Error: unknown tunnel provider '${next}'. Valid providers: ${VALID_PROVIDERS.join(", ")}.`,
+          `Error: unknown tunnel provider '${next}'. Valid providers: ${TUNNEL_PROVIDERS.join(", ")}.`,
         );
         console.error(
           `If this provider is documented, ${STALE_CLI_UPDATE_HINT}`,
         );
         process.exit(1);
       }
-      provider = next as TunnelProvider;
+      provider = next as TunnelProviderName;
       i++;
     } else if (arg === "--domain") {
       const next = args[i + 1];
       if (!next || next.startsWith("-")) {
+        const domainExample = PROVIDER_META[DEFAULT_TUNNEL_PROVIDER].domainExample;
         console.error(
-          "Error: --domain requires a value, e.g. --domain my-assistant.ngrok.app",
+          `Error: --domain requires a value${domainExample ? `, e.g. --domain ${domainExample}` : ""}`,
         );
         process.exit(1);
       }
@@ -210,32 +198,22 @@ function parseArgs(): TunnelArgs {
     parseAssistantTargetArg(args, FLAGS_WITH_VALUES) ?? null;
 
   if (provider === null) {
-    console.error(
-      "Error: --provider is required. How far the tunnel URL reaches depends on it, so there is no default.",
+    provider = DEFAULT_TUNNEL_PROVIDER;
+    console.log(
+      `Using the default provider: ${provider} (pass --provider to choose another).`,
     );
-    console.error("");
-    console.error("Run one of:");
-    // Carries the assistant through: dropping it would suggest a command that
-    // tunnels the active assistant instead of the one that was asked for.
-    const target = assistantName ? ` ${shellArg(assistantName)}` : "";
-    for (const name of TUNNEL_PROVIDERS) {
-      console.error(
-        `  cadet tunnel${target} --provider ${name.padEnd(13)}${PROVIDER_REACH[name]}`,
-      );
-    }
-    process.exit(1);
   }
 
-  if (domain && provider !== "ngrok") {
+  if (domain && !providerSupportsReservedDomain(provider)) {
     console.error(
-      `Error: --domain is only supported with --provider ngrok (got '${provider}').`,
+      `Error: --domain is not supported with --provider ${provider} (reserved domains have no equivalent there).`,
     );
     process.exit(1);
   }
 
-  if (clearDomain && provider !== "ngrok") {
+  if (clearDomain && !providerSupportsReservedDomain(provider)) {
     console.error(
-      `Error: --clear-domain is only supported with --provider ngrok (got '${provider}').`,
+      `Error: --clear-domain is not supported with --provider ${provider} (reserved domains have no equivalent there).`,
     );
     process.exit(1);
   }
@@ -259,7 +237,7 @@ interface LocalTunnelTarget {
 
 /**
  * Map an entry to its local tunnel target, or null when it has no locally
- * reachable gateway (e.g. platform-hosted). Entries with `resources` carry
+ * reachable gateway (e.g. cloud-hosted). Entries with `resources` carry
  * their own gateway port and instance workspace. Local container entries
  * (docker, apple-container) run locally without host resources: their gateway
  * port comes from localUrl/runtimeUrl and their ingress state lives in the
@@ -284,7 +262,7 @@ function toLocalTunnelTarget(entry: AssistantEntry): LocalTunnelTarget | null {
 
 function describeUntunnelableEntry(entry: AssistantEntry): string {
   const reference = formatAssistantReference(entry);
-  return isManagedCloud(entry.cloud)
+  return isCloudHome(entry.cloud)
     ? `Assistant '${reference}' runs on Cadet Cloud and needs no tunnel.`
     : `Assistant '${reference}' has no locally managed runtime to tunnel.`;
 }
@@ -292,7 +270,7 @@ function describeUntunnelableEntry(entry: AssistantEntry): string {
 /**
  * Resolve the assistant whose gateway and workspace the tunnel edge fronts.
  * Tunnels only make sense for assistants with a local gateway; when the
- * resolved entry has none (e.g. the active assistant is platform-hosted) and
+ * resolved entry has none (e.g. the active assistant is cloud-hosted) and
  * no name was given, fall back to the sole local target, otherwise exit with
  * an error naming the local assistants to pass explicitly.
  */
@@ -350,8 +328,8 @@ function guardTailnetOnlyWebhookIngress(workspaceDir: string): boolean {
   console.warn(
     "⚠ Webhook integrations are configured, and the tailscale tunnel is reachable only from your own tailnet, " +
       "so it cannot serve their callbacks. The saved ingress base URL stays as it is and the tailnet URL is " +
-      "recorded for device pairing only. For a tunnel those integrations can reach too, use --provider ngrok " +
-      "or --provider cloudflare.",
+      "recorded for device pairing only. For a tunnel those integrations can reach too, run `cadet tunnel --help` " +
+      "to see the public providers.",
   );
   return true;
 }
@@ -359,16 +337,15 @@ function guardTailnetOnlyWebhookIngress(workspaceDir: string): boolean {
 // Generous cap so a slow provider handshake (e.g. cloudflared's own ~30s
 // quick-tunnel timeout) still counts as a successful, if slow, start.
 const TUNNEL_BACKGROUND_START_TIMEOUT_MS = 35_000;
-// Matches the "just established" line every provider prints, or ngrok's
-// "found an already-running agent" adoption line (captured separately since
-// that case does not own the tunnel it adopted).
+// Matches the "just established" line every provider prints, or the adoption
+// line printed when a run adopts an already-running agent's tunnel (captured
+// separately since that case does not own the tunnel it adopted).
 const TUNNEL_ESTABLISHED_RE = /Tunnel established: (\S+)/;
-const TUNNEL_ADOPTED_RE = /Found existing ngrok tunnel: (\S+)/;
 
 /**
  * Re-invoke `cadet tunnel` (without `-d`/`--detach`) as a detached background
  * process via `relaunchDetached`, waiting for the child to either print its
- * "Tunnel established"/"Found existing ngrok tunnel" line (readiness) or
+ * "Tunnel established" or adopted-tunnel line (readiness) or
  * exit early (failure), so a misconfigured provider still fails loudly in
  * the terminal that ran `-d`.
  *
@@ -404,7 +381,7 @@ async function spawnDetachedTunnel(): Promise<void> {
         publicUrl = established[1];
         return true;
       }
-      const adoptedMatch = TUNNEL_ADOPTED_RE.exec(logText);
+      const adoptedMatch = ADOPTED_TUNNEL_RE.exec(logText);
       if (adoptedMatch) {
         publicUrl = adoptedMatch[1];
         adopted = true;
@@ -430,11 +407,7 @@ async function spawnDetachedTunnel(): Promise<void> {
   }
   console.log(`Running in background (pid ${child.pid}). Logs: ${logPath}`);
   if (adopted) {
-    console.log(
-      `That ngrok agent was already running outside this command, so \`kill ${child.pid}\` only ` +
-        "stops this supervisor, not the ngrok tunnel or its saved ingress URL. Stop the ngrok agent " +
-        "directly to end the tunnel.",
-    );
+    console.log(adoptedTunnelStopNotice(child.pid));
   } else {
     console.log(`Stop with: kill ${child.pid}`);
   }
@@ -449,11 +422,8 @@ export const tunnel = Object.assign(
     return;
   }
 
-  if (provider === "cadet") {
-    throw new Error(
-      `Tunnel provider '${provider}' is not yet implemented. ` +
-        `If this provider is documented, ${STALE_CLI_UPDATE_HINT}`,
-    );
+  if (PROVIDER_META[provider].comingSoon) {
+    throw cadetTunnelComingSoonError(provider);
   }
 
   const { entry, gatewayPort, workspaceDir } =
@@ -463,8 +433,8 @@ export const tunnel = Object.assign(
     provider === "tailscale" && guardTailnetOnlyWebhookIngress(workspaceDir);
 
   if (clearDomain) {
-    saveNgrokDomain(workspaceDir, null);
-    console.log("Cleared the saved ngrok domain from the workspace config.");
+    clearReservedDomain();
+    console.log("Cleared the saved reserved domain.");
   }
 
   let edge: TunnelEdge;
@@ -490,21 +460,9 @@ export const tunnel = Object.assign(
     workspaceDir,
   };
 
-  if (provider === "ngrok") {
-    await runNgrokTunnel({
-      ...baseTunnelOpts,
-      ...(domain ? { domain } : {}),
-    });
-    return;
-  }
-
-  if (provider === "cloudflare") {
-    await runCloudflareTunnel(baseTunnelOpts);
-    return;
-  }
-
-  await runTailscaleTunnel({
+  await runProviderTunnel(provider, {
     ...baseTunnelOpts,
+    ...(domain ? { domain } : {}),
     ...(preserveIngressUrl ? { preserveIngressUrl } : {}),
   });
 },