@openchambery/web 1.17.1-beta.7 → 1.17.1-beta.8

package/README.md

@@ -29,14 +29,6 @@ openchamber startup enable           # Start at login as a native service
 OPENCHAMBER_UI_PASSWORD=secret openchamber startup enable # Save service password env
 openchamber startup status           # Show startup service status
 openchamber startup disable          # Remove startup service
-openchamber tunnel help              # Tunnel lifecycle commands
-openchamber tunnel providers         # Show provider capabilities
-openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token <token>
-openchamber tunnel start --profile prod-main
-openchamber tunnel start --provider cloudflare --mode quick --qr
-openchamber tunnel start --provider cloudflare --mode managed-local --config ~/.cloudflared/config.yml
-openchamber tunnel status --all      # Show tunnel state across instances
-openchamber tunnel stop --port 3000  # Stop tunnel only (server stays running)
 openchamber connect-url --port 3000  # Add this server to OpenChamber Desktop
 openchamber connect-url --server http://host:3000 --qr
 openchamber connect-url --port 3000 --qr
@@ -80,13 +72,6 @@ The **Add a device** dialog defaults to `wss://relay.openchamber.dev/ws` and let
 
 Saved pairing candidates retain their endpoint snapshot, including the Relay URL. Mobile and Desktop clients reconnect through that saved endpoint until a new pairing flow replaces it. See [OpenChamber Relay Server](https://github.com/yee94/openchamber/tree/main/packages/relay-server#readme) for bundle builds, reverse-proxy configuration, security, operations, and systemd guidance.
 
-### Tunnel behavior notes
-
-- One active tunnel per running OpenChamber instance (port).
-- Starting a different tunnel mode/provider on the same instance replaces the active tunnel.
-- Replacing or stopping a tunnel revokes existing connect links and invalidates remote tunnel sessions.
-- Connect links are one-time tokens; generating a new link revokes the previous unused link.
-
 ### Connect other OpenChamber apps
 
 Use `connect-url` when a web/API server should be added to OpenChamber Desktop or another OpenChamber app. If no server is running on the selected port, OpenChamber starts one first.
@@ -157,30 +142,9 @@ OPENCHAMBER_OPENCODE_HOSTNAME=0.0.0.0 openchamber --port 3000
 ```yaml
 environment:
   UI_PASSWORD: your_secure_password
-  OPENCHAMBER_TUNNEL_MODE: quick # quick | managed-remote | managed-local
-  OPENCHAMBER_TUNNEL_PROVIDER: cloudflare
   OPENCHAMBER_UPDATE_API_URL: https://updates.example.com/v1/update/check # Primary compatible update-check service; Vercel and GitHub Releases provide fallback
 ```
 
-For `managed-remote` mode, also set:
-
-```yaml
-environment:
-  OPENCHAMBER_TUNNEL_MODE: managed-remote
-  OPENCHAMBER_TUNNEL_HOSTNAME: app.example.com
-  OPENCHAMBER_TUNNEL_TOKEN: <token>
-```
-
-For `managed-local` mode, you can set:
-
-```yaml
-environment:
-  OPENCHAMBER_TUNNEL_MODE: managed-local
-  OPENCHAMBER_TUNNEL_CONFIG: /home/openchamber/.cloudflared/config.yml
-```
-
-Managed-local path note: `OPENCHAMBER_TUNNEL_CONFIG` must use a container path under `/home/openchamber/...`. If the config file references `credentials-file`, ensure that JSON path is also mounted and reachable inside the container.
-
 **Data directory:** mount `data/` for persistent storage. Ensure permissions:
 ```bash
 mkdir -p data/openchamber data/opencode/share data/opencode/config data/ssh
@@ -256,14 +220,14 @@ systemctl --user enable --now opencode openchamber
 
 ## What makes the web version special
 
-- **Remote access** - Cloudflare tunnel with QR onboarding. Scan from your phone, start coding.
+- **Remote access** - LAN pairing and private relay with QR onboarding. Scan from your phone, start coding.
 - **Mobile-first PWA** - optimized chat controls, keyboard-safe layouts, drag-to-reorder projects
 - **Background notifications** - know when your agent finishes, even from another tab
 - **Self-update** - update and restart from the UI, server settings stay intact
 - **Cross-tab tracking** - session activity stays in sync across browser tabs
 
-- Cloudflare tunnel access with quick, managed-remote, and managed-local modes
-- One-scan onboarding with tunnel QR + password URL helpers
+- LAN pairing and private relay for reaching a host that is not publicly exposed
+- One-scan onboarding with pairing QR links
 - Mobile-first experience: optimized chat controls, keyboard-safe layouts, and attachment-friendly UI
 - Background notifications plus reliable cross-tab session activity tracking
 - Built-in self-update + restart flow that keeps your server settings intact

package/bin/cli-output.js

@@ -21,21 +21,6 @@ import {
   isCancel,
 } from '@clack/prompts';
 
-// ── Provider icons ──────────────────────────────────────────────
-
-const TUNNEL_PROVIDER_ICON = {
-  cloudflare: '☁',
-};
-
-function formatProviderWithIcon(provider) {
-  if (typeof provider !== 'string' || provider.trim().length === 0) {
-    return 'unknown';
-  }
-  const normalized = provider.trim().toLowerCase();
-  const icon = TUNNEL_PROVIDER_ICON[normalized];
-  return icon ? `${icon} ${normalized}` : normalized;
-}
-
 // ── Status-aware log dispatch ───────────────────────────────────
 
 /**
@@ -135,6 +120,5 @@ export {
   createSpinner,
   createProgress,
   printJson,
-  formatProviderWithIcon,
   logStatus,
 };

package/bin/cli.js

@@ -10,21 +10,11 @@ import {
   hasUiPasswordConfigured,
   assertAuthenticatedNetworkExposure,
 } from './lib/cli-network.js';
-import {
-  maskToken,
-  resolveToken,
-  redactProfileForOutput,
-  redactProfilesForOutput,
-  warnIfUnsafeFilePermissions,
-  ensureTunnelProfilesMigrated as ensureTunnelProfilesMigratedBase,
-} from './lib/cli-tunnel-profiles.js';
 import {
   parseArgs,
   showHelp,
   showStartupHelp,
   showConnectUrlHelp,
-  showTunnelHelp,
-  generateCompletionScript,
   findClosestMatch,
 } from './lib/cli-args.js';
 import { readDesktopLocalPortFromSettings } from './lib/cli-paths.js';
@@ -36,17 +26,13 @@ import { createUpdateCommand } from './lib/commands-update.js';
 import { createConnectUrlCommand } from './lib/commands-connect-url.js';
 import { createLifecycleCommands } from './lib/commands-lifecycle.js';
 import { createServeCommand } from './lib/commands-serve.js';
-import { createTunnelCommand, isValidTunnelDoctorResponse, shouldDisplayTunnelQr } from './lib/commands-tunnel.js';
 import {
-  resolveDoctorPortStatuses,
   discoverRunningInstances,
   discoverOpenChamberInstanceOnPort,
   discoverLifecycleInstances,
   discoverUnconfirmedRegistryInstanceOnPort,
-  resolveTunnelProviders,
 } from './lib/cli-lifecycle.js';
 import {
-  fetchTunnelProvidersFromPort,
   fetchSystemInfoFromPort,
 } from './lib/cli-http.js';
 import {
@@ -60,7 +46,6 @@ import {
 import {
   intro as clackIntro, outro as clackOutro, cancel as clackCancel,
   isJsonMode,
-  isQuietMode,
   printJson,
   logStatus,
 } from './cli-output.js';
@@ -70,24 +55,10 @@ const __dirname = path.dirname(__filename);
 
 const PACKAGE_JSON = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
 
-let onCancelCleanup = null;
 let activeCommandOptions = null;
 let foregroundServerActive = false;
 let foregroundShutdown = null;
 
-function setCancelCleanup(handler) {
-  onCancelCleanup = typeof handler === 'function' ? handler : null;
-}
-
-function shouldWarnForTunnelProfileFile() {
-  if (!activeCommandOptions) return false;
-  return !isJsonMode(activeCommandOptions) && !isQuietMode(activeCommandOptions);
-}
-
-function ensureTunnelProfilesMigrated() {
-  return ensureTunnelProfilesMigratedBase({ shouldWarn: shouldWarnForTunnelProfileFile() });
-}
-
 const HAS_PLAIN_FLAG = process.argv.includes('--plain');
 const STYLE_ENABLED = process.stdout.isTTY && process.env.NO_COLOR !== '1' && !HAS_PLAIN_FLAG;
 const ANSI = {
@@ -163,14 +134,6 @@ commands.serve = createServeCommand({
   commands.restart = lifecycleCommands.restart;
 }
 
-commands.tunnel = createTunnelCommand({
-  serveCommand: commands.serve.bind(commands),
-  stopCommand: commands.stop.bind(commands),
-  setCancelCleanup,
-  boldText,
-  ensureTunnelProfilesMigrated,
-});
-
 commands['connect-url'] = createConnectUrlCommand({
   serveCommand: commands.serve.bind(commands),
 });
@@ -183,7 +146,7 @@ commands.update = createUpdateCommand({
 
 async function main() {
   const parsed = parseArgs();
-  const { command, subcommand, tunnelAction, startupAction, options, removedFlagErrors, helpRequested, versionRequested } = parsed;
+  const { command, startupAction, options, removedFlagErrors, helpRequested, versionRequested } = parsed;
   activeCommandOptions = options;
 
   if (versionRequested) {
@@ -213,9 +176,7 @@ async function main() {
   }
 
   if (helpRequested) {
-    if (command === 'tunnel') {
-      showTunnelHelp();
-    } else if (command === 'startup') {
+    if (command === 'startup') {
       showStartupHelp();
     } else if (command === 'connect-url') {
       showConnectUrlHelp();
@@ -225,18 +186,13 @@ async function main() {
     return;
   }
 
-  if (command === 'tunnel') {
-    await commands.tunnel(options, subcommand, tunnelAction);
-    return;
-  }
-
   if (command === 'startup') {
     await commands.startup(options, startupAction);
     return;
   }
 
   if (!commands[command]) {
-    const knownCommands = ['serve', 'stop', 'restart', 'status', 'tunnel', 'startup', 'logs', 'update'];
+    const knownCommands = ['serve', 'stop', 'restart', 'status', 'startup', 'logs', 'connect-url', 'update'];
     const suggestion = findClosestMatch(command, knownCommands);
     const hint = suggestion ? ` Did you mean '${suggestion}'?` : '';
     if (isJsonMode(options)) {
@@ -274,14 +230,6 @@ if (isCliExecution) {
     isHandlingSigint = true;
     (async () => {
       clackCancel('Operation cancelled.');
-      if (onCancelCleanup) {
-        try {
-          await onCancelCleanup();
-        } catch {
-        } finally {
-          setCancelCleanup(null);
-        }
-      }
       process.exit(130);
     })();
   });
@@ -341,8 +289,6 @@ export {
   assertAuthenticatedNetworkExposure,
   resolveServeHost,
   hasUiPasswordConfigured,
-  shouldDisplayTunnelQr,
-  isValidTunnelDoctorResponse,
   readDesktopLocalPortFromSettings,
   getPidFilePath,
   getInstanceFilePath,
@@ -350,21 +296,12 @@ export {
   isOpenchamberProcessRunning,
   isOpenchamberCmdline,
   getOpenchamberProcessState,
-  resolveTunnelProviders,
-  fetchTunnelProvidersFromPort,
   fetchSystemInfoFromPort,
   discoverRunningInstances,
   discoverOpenChamberInstanceOnPort,
   discoverLifecycleInstances,
   discoverUnconfirmedRegistryInstanceOnPort,
-  ensureTunnelProfilesMigrated,
-  resolveToken,
-  redactProfileForOutput,
-  redactProfilesForOutput,
-  maskToken,
   findClosestMatch,
-  generateCompletionScript,
   TunnelCliError,
   EXIT_CODE,
-  warnIfUnsafeFilePermissions,
 };

package/bin/cli.test.js

@@ -10,11 +10,6 @@ import { pathToFileURL } from 'url';
 import { isModuleCliExecution, normalizeCliEntryPath } from './cli-entry.js';
 import { requestJson } from './lib/cli-http.js';
 import { inspectTunnelAttachability } from './lib/cli-lifecycle.js';
-import { DEFAULT_TUNNEL_PROVIDER_CAPABILITIES } from './lib/cli-tunnel-capabilities.js';
-import {
-  TUNNEL_PROVIDER_CLOUDFLARE,
-  TUNNEL_PROVIDER_NGROK,
-} from '../server/lib/tunnels/types.js';
 import {
   assertAuthenticatedNetworkExposure,
   commands,
@@ -22,7 +17,6 @@ import {
   discoverLifecycleInstances,
   discoverRunningInstances,
   discoverUnconfirmedRegistryInstanceOnPort,
-  ensureTunnelProfilesMigrated,
   getInstanceFilePath,
   getPidFilePath,
   isOpenchamberCmdline,
@@ -178,13 +172,6 @@ function spawnOpenChamberLikeHungServer(port) {
 }
 
 describe('cli args', () => {
-  it('loads fallback tunnel provider capabilities for CLI startup', () => {
-    expect(DEFAULT_TUNNEL_PROVIDER_CAPABILITIES.map((provider) => provider.provider)).toEqual([
-      TUNNEL_PROVIDER_CLOUDFLARE,
-      TUNNEL_PROVIDER_NGROK,
-    ]);
-  });
-
   it('accepts legacy daemon flags as no-ops', () => {
     expect(parseArgs(['serve', '--daemon']).removedFlagErrors).toEqual([]);
     expect(parseArgs(['serve', '-d']).removedFlagErrors).toEqual([]);
@@ -229,17 +216,6 @@ describe('cli args', () => {
     expect(parsed.options.port).toBe(3002);
   });
 
-  it('parses tunnel auto-start server options', () => {
-    const parsed = parseArgs(['tunnel', 'start', '--port', '3002', '--api-only', '--lan', '--ui-password', 'secret']);
-
-    expect(parsed.command).toBe('tunnel');
-    expect(parsed.subcommand).toBe('start');
-    expect(parsed.options.port).toBe(3002);
-    expect(parsed.options.apiOnly).toBe(true);
-    expect(parsed.options.host).toBe('0.0.0.0');
-    expect(parsed.options.uiPassword).toBe('secret');
-  });
-
   it('maps --lan to wildcard bind host', () => {
     const parsed = parseArgs(['serve', '--lan', '--port', '3002']);
 
@@ -252,13 +228,6 @@ describe('cli args', () => {
 
     expect(parsed.options.host).toBe('0.0.0.0');
   });
-
-  it('keeps --hostname for tunnel commands', () => {
-    const parsed = parseArgs(['tunnel', 'start', '--hostname', 'app.example.com']);
-
-    expect(parsed.options.hostname).toBe('app.example.com');
-    expect(parsed.options.host).toBeUndefined();
-  });
 });
 
 describe('network-exposed auth validation', () => {
@@ -322,51 +291,6 @@ describe('serve host resolution', () => {
   });
 });
 
-describe('compatibility exports', () => {
-  it('allows tunnel profile migration before command options are initialized', async () => {
-    await withTempOpenChamberDataDir(async () => {
-      const store = ensureTunnelProfilesMigrated();
-
-      expect(store).toEqual({ version: 1, profiles: [] });
-    });
-  });
-
-  it('includes ngrok in fallback tunnel providers when no server is reachable', async () => {
-    await withTempOpenChamberDataDir(async () => {
-      const output = await captureStdout(async () => {
-        await commands.tunnel({ json: true }, 'providers');
-      });
-
-      const body = JSON.parse(output);
-      expect(body.source).toBe('fallback');
-      expect(body.providers.map((entry) => entry.provider)).toContain('ngrok');
-    });
-  });
-
-  it('supports ngrok quick dry-run with an explicit port', async () => {
-    await withTempOpenChamberDataDir(async () => {
-      const output = await captureStdout(async () => {
-        await commands.tunnel({
-          json: true,
-          dryRun: true,
-          explicitPort: true,
-          port: 3003,
-          provider: 'ngrok',
-          mode: 'quick',
-        }, 'start');
-      });
-
-      const body = JSON.parse(output);
-      expect(body).toEqual(expect.objectContaining({
-        ok: true,
-        dryRun: true,
-        provider: 'ngrok',
-        mode: 'quick',
-      }));
-    });
-  });
-});
-
 describe('CLI HTTP helpers', () => {
   it('retries UI-authenticated API requests with the stored instance password', async () => {
     await withTempOpenChamberDataDir(async () => {
@@ -395,17 +319,16 @@ describe('CLI HTTP helpers', () => {
       };
 
       try {
-        const { response, body } = await requestJson(port, '/api/openchamber/tunnel/start', {
-          method: 'POST',
-          body: JSON.stringify({ provider: 'ngrok', mode: 'quick' }),
+        const { response, body } = await requestJson(port, '/api/openchamber/relay/status', {
+          method: 'GET',
         });
 
         expect(response.ok).toBe(true);
         expect(body).toEqual({ ok: true });
         expect(calls.map((call) => new URL(call.url).pathname)).toEqual([
-          '/api/openchamber/tunnel/start',
+          '/api/openchamber/relay/status',
           '/auth/session',
-          '/api/openchamber/tunnel/start',
+          '/api/openchamber/relay/status',
         ]);
       } finally {
         globalThis.fetch = originalFetch;

package/bin/lib/DOCUMENTATION.md

@@ -26,7 +26,7 @@ Command modules implement user-facing commands and preserve output contracts acr
 
 - `commands-status.js`
   - Implements `openchamber status`.
-  - Formats discovered instances and tunnel readiness/status for human, quiet, and JSON output.
+  - Formats discovered instances for human, quiet, and JSON output.
 
 - `commands-logs.js`
   - Implements `openchamber logs`.
@@ -47,11 +47,6 @@ Command modules implement user-facing commands and preserve output contracts acr
   - Implements `openchamber update`.
   - Loads the package-manager helper, performs update flow, and coordinates restart behavior after updates.
 
-- `commands-tunnel.js`
-  - Implements `openchamber tunnel` and its subcommands: `profile`, `providers`, `ready`, `doctor`, `status`, `start`, `stop`, and `completion`.
-  - Owns tunnel-specific command flow, interactive prompt decisions, managed-local/managed-remote startup, QR display rules, tunnel start/stop API calls, and tunnel profile command handling.
-  - Receives `serveCommand` and `stopCommand` by dependency injection. Do not reach back into `cli.js` command globals from this module.
-
 ## Shared Helper Modules
 
 These modules hold reusable, non-presentational logic for commands.
@@ -60,19 +55,19 @@ These modules hold reusable, non-presentational logic for commands.
   - Argument parsing, defaults, help text, completion script generation, and typo suggestions.
 
 - `cli-errors.js`
-  - CLI exit codes and typed tunnel CLI errors.
+  - CLI exit codes and typed CLI errors.
 
 - `cli-paths.js`
-  - Data, run, log, settings, tunnel profile, and managed-local config paths.
+  - Data, run, log, and settings paths.
 
 - `cli-process.js`
   - PID files, instance registry files, process identity checks, runtime metadata checks, and process termination helpers.
 
 - `cli-lifecycle.js`
-  - Instance discovery, live health probing, attachability checks, provider discovery, and status aggregation used by lifecycle/status/tunnel commands.
+  - Instance discovery, live health probing, attachability checks, and status aggregation used by lifecycle/status commands.
 
 - `cli-http.js`
-  - HTTP helpers for health checks, shutdown requests, JSON API calls, tunnel provider fetches, and system info fetches.
+  - HTTP helpers for health checks, shutdown requests, JSON API calls, and system info fetches.
 
 - `cli-network.js`
   - Host resolution, URL building, LAN detection, unsafe browser port validation, and UI password/network exposure checks.
@@ -89,15 +84,6 @@ These modules hold reusable, non-presentational logic for commands.
 - `cli-startup.js`
   - Native startup service detection, install/uninstall/status helpers, and platform-specific startup command execution.
 
-- `cli-tunnel-profiles.js`
-  - Tunnel profile normalization, token resolution/redaction, profile storage, migration, file-permission warnings, and managed-remote pair persistence.
-
-- `cli-tunnel-utils.js`
-  - Tunnel-specific command string builders, TTL parsing/formatting, and replay command helpers.
-
-- `cli-tunnel-capabilities.js`
-  - Built-in tunnel provider capability fallbacks used when a live server cannot provide tunnel metadata.
-
 ## Placement Rules
 
 - Add new CLI commands as `commands-*.js` modules and wire them from `cli.js`.