@openchambery/web 1.17.1-beta.7 → 1.17.1-beta.8

package/server/lib/opencode/server-startup-runtime.js

@@ -1,19 +1,11 @@
 export const createServerStartupRuntime = (dependencies) => {
   const {
     process,
-    crypto,
     server,
-    normalizeTunnelBootstrapTtlMs,
-    readSettingsFromDiskMigrated,
-    tunnelAuthController,
-    startTunnelWithNormalizedRequest,
     gracefulShutdown,
     getSignalsAttached,
     setSignalsAttached,
     syncToHmrState,
-    TUNNEL_MODE_QUICK,
-    TUNNEL_MODE_MANAGED_LOCAL,
-    TUNNEL_MODE_MANAGED_REMOTE,
   } = dependencies;
 
   const resolveBindHost = (host) =>
@@ -25,8 +17,6 @@ export const createServerStartupRuntime = (dependencies) => {
   const startListeningAndMaybeTunnel = async ({
     port,
     bindHost,
-    startupTunnelRequest,
-    onTunnelReady,
   }) => {
     let activePort = port;
 
@@ -69,51 +59,6 @@ export const createServerStartupRuntime = (dependencies) => {
           console.log(`Health check: http://${displayHost}:${activePort}/health`);
           console.log(`Web interface: http://${displayHost}:${activePort}`);
 
-          if (startupTunnelRequest) {
-            const startupModeLabel = startupTunnelRequest.mode === TUNNEL_MODE_QUICK
-              ? 'Quick Tunnel'
-              : (startupTunnelRequest.mode === TUNNEL_MODE_MANAGED_LOCAL
-                ? 'Managed Local Tunnel'
-                : (startupTunnelRequest.mode === TUNNEL_MODE_MANAGED_REMOTE ? 'Managed Remote Tunnel' : 'Tunnel'));
-            console.log(`\nInitializing ${startupModeLabel} for provider '${startupTunnelRequest.provider}'...`);
-            try {
-              const { publicUrl, mode } = await startTunnelWithNormalizedRequest({
-                provider: startupTunnelRequest.provider,
-                mode: startupTunnelRequest.mode,
-                intent: startupTunnelRequest.intent,
-                hostname: startupTunnelRequest.hostname,
-                token: startupTunnelRequest.token,
-                configPath: startupTunnelRequest.configPath,
-                selectedPresetId: '',
-                selectedPresetName: '',
-              });
-              if (publicUrl) {
-                tunnelAuthController.setActiveTunnel({
-                  tunnelId: crypto.randomUUID(),
-                  publicUrl,
-                  mode,
-                });
-                const settings = await readSettingsFromDiskMigrated();
-                const bootstrapTtlMs = settings?.tunnelBootstrapTtlMs === null
-                  ? null
-                  : normalizeTunnelBootstrapTtlMs(settings?.tunnelBootstrapTtlMs);
-                const bootstrapToken = tunnelAuthController.issueBootstrapToken({ ttlMs: bootstrapTtlMs });
-                const connectUrl = `${publicUrl.replace(/\/$/, '')}/connect?t=${encodeURIComponent(bootstrapToken.token)}`;
-                if (onTunnelReady) {
-                  onTunnelReady(publicUrl, connectUrl);
-                } else {
-                  console.log(`\n🌐 Tunnel URL: ${connectUrl}`);
-                  console.log('🔑 One-time connect link (expires after first use)\n');
-                }
-              } else if (onTunnelReady) {
-                onTunnelReady(publicUrl, null);
-              }
-            } catch (error) {
-              console.error(`Failed to start tunnel: ${error.message}`);
-              console.log('Continuing without tunnel...');
-            }
-          }
-
           resolve();
         } catch (error) {
           reject(error);

package/server/lib/opencode/settings-helpers.js

@@ -57,14 +57,6 @@ export const createSettingsHelpers = (dependencies) => {
   const {
     normalizePathForPersistence,
     normalizeDirectoryPath,
-    normalizeTunnelBootstrapTtlMs,
-    normalizeTunnelSessionTtlMs,
-    normalizeTunnelProvider,
-    normalizeTunnelMode,
-    normalizeOptionalPath,
-    normalizeManagedRemoteTunnelHostname,
-    normalizeManagedRemoteTunnelPresets,
-    normalizeManagedRemoteTunnelPresetTokens,
     sanitizeTypographySizesPartial,
     normalizeStringArray,
     sanitizeModelRefs,
@@ -408,50 +400,6 @@ export const createSettingsHelpers = (dependencies) => {
       const normalizedDays = Math.max(1, Math.min(365, Math.round(candidate.autoDeleteAfterDays)));
       result.autoDeleteAfterDays = normalizedDays;
     }
-    if (candidate.tunnelBootstrapTtlMs === null) {
-      result.tunnelBootstrapTtlMs = null;
-    } else if (typeof candidate.tunnelBootstrapTtlMs === 'number' && Number.isFinite(candidate.tunnelBootstrapTtlMs)) {
-      result.tunnelBootstrapTtlMs = normalizeTunnelBootstrapTtlMs(candidate.tunnelBootstrapTtlMs);
-    }
-    if (typeof candidate.tunnelSessionTtlMs === 'number' && Number.isFinite(candidate.tunnelSessionTtlMs)) {
-      result.tunnelSessionTtlMs = normalizeTunnelSessionTtlMs(candidate.tunnelSessionTtlMs);
-    }
-    if (typeof candidate.tunnelProvider === 'string') {
-      const provider = normalizeTunnelProvider(candidate.tunnelProvider);
-      if (provider) {
-        result.tunnelProvider = provider;
-      }
-    }
-    if (typeof candidate.tunnelMode === 'string') {
-      result.tunnelMode = normalizeTunnelMode(candidate.tunnelMode);
-    }
-    if (candidate.managedLocalTunnelConfigPath === null) {
-      result.managedLocalTunnelConfigPath = null;
-    } else if (typeof candidate.managedLocalTunnelConfigPath === 'string') {
-      const trimmed = candidate.managedLocalTunnelConfigPath.trim();
-      result.managedLocalTunnelConfigPath = trimmed.length > 0 ? normalizeOptionalPath(trimmed) : null;
-    }
-    if (typeof candidate.managedRemoteTunnelHostname === 'string') {
-      const hostname = normalizeManagedRemoteTunnelHostname(candidate.managedRemoteTunnelHostname);
-      result.managedRemoteTunnelHostname = hostname;
-    }
-    if (candidate.managedRemoteTunnelToken === null) {
-      result.managedRemoteTunnelToken = null;
-    } else if (typeof candidate.managedRemoteTunnelToken === 'string') {
-      result.managedRemoteTunnelToken = candidate.managedRemoteTunnelToken.trim();
-    }
-    const managedRemoteTunnelPresets = normalizeManagedRemoteTunnelPresets(candidate.managedRemoteTunnelPresets);
-    if (managedRemoteTunnelPresets) {
-      result.managedRemoteTunnelPresets = managedRemoteTunnelPresets;
-    }
-    const managedRemoteTunnelPresetTokens = normalizeManagedRemoteTunnelPresetTokens(candidate.managedRemoteTunnelPresetTokens);
-    if (managedRemoteTunnelPresetTokens) {
-      result.managedRemoteTunnelPresetTokens = managedRemoteTunnelPresetTokens;
-    }
-    if (typeof candidate.managedRemoteTunnelSelectedPresetId === 'string') {
-      const id = candidate.managedRemoteTunnelSelectedPresetId.trim();
-      result.managedRemoteTunnelSelectedPresetId = id || undefined;
-    }
 
     const typography = sanitizeTypographySizesPartial(candidate.typographySizes);
     if (typography) {
@@ -945,10 +893,8 @@ export const createSettingsHelpers = (dependencies) => {
 
   const formatSettingsResponse = (settings) => {
     const sanitized = sanitizeSettingsUpdate(settings);
-    delete sanitized.managedRemoteTunnelToken;
     delete sanitized.summaryCustomAPIToken;
     const bookmarks = normalizeStringArray(settings.securityScopedBookmarks);
-    const hasManagedRemoteTunnelToken = typeof settings?.managedRemoteTunnelToken === 'string' && settings.managedRemoteTunnelToken.trim().length > 0;
     const hasSummaryCustomAPIToken = typeof settings?.summaryCustomAPIToken === 'string' && settings.summaryCustomAPIToken.trim().length > 0;
     const pwaAppName = normalizePwaAppName(settings?.pwaAppName, '');
     const pwaOrientation = normalizePwaOrientation(settings?.pwaOrientation, 'system');
@@ -956,7 +902,6 @@ export const createSettingsHelpers = (dependencies) => {
 
     return {
       ...sanitized,
-      hasManagedRemoteTunnelToken,
       hasSummaryCustomAPIToken,
       ...(pwaAppName ? { pwaAppName } : {}),
       pwaOrientation,

package/server/lib/opencode/settings-helpers.test.js

@@ -6,14 +6,6 @@ import { createSettingsNormalizationRuntime } from './settings-normalization-run
 const createTestHelpers = () => createSettingsHelpers({
   normalizePathForPersistence: (value) => value,
   normalizeDirectoryPath: (value) => value,
-  normalizeTunnelBootstrapTtlMs: (value) => value,
-  normalizeTunnelSessionTtlMs: (value) => value,
-  normalizeTunnelProvider: (value) => value,
-  normalizeTunnelMode: (value) => value,
-  normalizeOptionalPath: (value) => value,
-  normalizeManagedRemoteTunnelHostname: (value) => value,
-  normalizeManagedRemoteTunnelPresets: () => undefined,
-  normalizeManagedRemoteTunnelPresetTokens: () => undefined,
   sanitizeTypographySizesPartial: () => undefined,
   normalizeStringArray: (input) => input,
   sanitizeModelRefs: () => undefined,
@@ -31,9 +23,6 @@ const createTestHelpersWithRealSanitizers = () => {
     },
     processLike: { platform: 'linux', env: {} },
     realpathSync: (p) => p,
-    tunnelBootstrapTtlDefaultMs: 600000,
-    tunnelBootstrapTtlMinMs: 60000,
-    tunnelBootstrapTtlMaxMs: 3600000,
     tunnelSessionTtlDefaultMs: 86400000,
     tunnelSessionTtlMinMs: 3600000,
     tunnelSessionTtlMaxMs: 604800000,
@@ -41,14 +30,6 @@ const createTestHelpersWithRealSanitizers = () => {
   return createSettingsHelpers({
     normalizePathForPersistence: (value) => value,
     normalizeDirectoryPath: (value) => value,
-    normalizeTunnelBootstrapTtlMs: (value) => value,
-    normalizeTunnelSessionTtlMs: (value) => value,
-    normalizeTunnelProvider: (value) => value,
-    normalizeTunnelMode: (value) => value,
-    normalizeOptionalPath: (value) => value,
-    normalizeManagedRemoteTunnelHostname: (value) => value,
-    normalizeManagedRemoteTunnelPresets: () => undefined,
-    normalizeManagedRemoteTunnelPresetTokens: () => undefined,
     sanitizeTypographySizesPartial: () => undefined,
     normalizeStringArray: runtime.normalizeStringArray,
     sanitizeModelRefs: runtime.sanitizeModelRefs,
@@ -305,7 +286,6 @@ describe('settings helpers', () => {
     const secretSentinel = 'bootstrap-secret-sentinel';
     const response = helpers.projectBootstrapSettingsResponse({
       summaryCustomAPIToken: secretSentinel,
-      managedRemoteTunnelToken: secretSentinel,
       defaultModel: 'm'.repeat(513),
       messageStreamTransport: 'websocket',
       sttProvider: 'server',

package/server/lib/opencode/settings-normalization-runtime.js

@@ -4,9 +4,6 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
     path,
     processLike,
     realpathSync,
-    tunnelBootstrapTtlDefaultMs,
-    tunnelBootstrapTtlMinMs,
-    tunnelBootstrapTtlMaxMs,
     tunnelSessionTtlDefaultMs,
     tunnelSessionTtlMinMs,
     tunnelSessionTtlMaxMs,
@@ -267,16 +264,6 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
 
   const clampNumber = (value, min, max) => Math.max(min, Math.min(max, value));
 
-  const normalizeTunnelBootstrapTtlMs = (value) => {
-    if (value === null) {
-      return null;
-    }
-    if (!Number.isFinite(value)) {
-      return tunnelBootstrapTtlDefaultMs;
-    }
-    return clampNumber(Math.round(value), tunnelBootstrapTtlMinMs, tunnelBootstrapTtlMaxMs);
-  };
-
   const normalizeTunnelSessionTtlMs = (value) => {
     if (!Number.isFinite(value)) {
       return tunnelSessionTtlDefaultMs;
@@ -284,76 +271,6 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
     return clampNumber(Math.round(value), tunnelSessionTtlMinMs, tunnelSessionTtlMaxMs);
   };
 
-  const normalizeManagedRemoteTunnelHostname = (value) => {
-    if (typeof value !== 'string') {
-      return undefined;
-    }
-    const trimmed = value.trim();
-    if (!trimmed) {
-      return undefined;
-    }
-
-    const parsed = (() => {
-      try {
-        if (trimmed.includes('://')) {
-          return new URL(trimmed);
-        }
-        return new URL(`https://${trimmed}`);
-      } catch {
-        return null;
-      }
-    })();
-
-    const hostname = parsed?.hostname?.trim().toLowerCase() || '';
-    if (!hostname) {
-      return undefined;
-    }
-    return hostname;
-  };
-
-  const normalizeManagedRemoteTunnelPresets = (value) => {
-    if (!Array.isArray(value)) {
-      return undefined;
-    }
-
-    const result = [];
-    const seenIds = new Set();
-    const seenHostnames = new Set();
-
-    for (const entry of value) {
-      if (!entry || typeof entry !== 'object') continue;
-      const candidate = entry;
-      const id = typeof candidate.id === 'string' ? candidate.id.trim() : '';
-      const name = typeof candidate.name === 'string' ? candidate.name.trim() : '';
-      const hostname = normalizeManagedRemoteTunnelHostname(candidate.hostname);
-      if (!id || !name || !hostname) continue;
-      if (seenIds.has(id) || seenHostnames.has(hostname)) continue;
-      seenIds.add(id);
-      seenHostnames.add(hostname);
-      result.push({ id, name, hostname });
-    }
-
-    return result;
-  };
-
-  const normalizeManagedRemoteTunnelPresetTokens = (value) => {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-      return undefined;
-    }
-
-    const result = {};
-    for (const [rawId, rawToken] of Object.entries(value)) {
-      const id = typeof rawId === 'string' ? rawId.trim() : '';
-      const token = typeof rawToken === 'string' ? rawToken.trim() : '';
-      if (!id || !token) {
-        continue;
-      }
-      result[id] = token;
-    }
-
-    return Object.keys(result).length > 0 ? result : undefined;
-  };
-
   const isUnsafeSkillRelativePath = (value) => {
     if (typeof value !== 'string' || value.length === 0) {
       return true;
@@ -452,11 +369,7 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
     normalizeDirectoryPath,
     normalizePathForPersistence,
     normalizeSettingsPaths,
-    normalizeTunnelBootstrapTtlMs,
     normalizeTunnelSessionTtlMs,
-    normalizeManagedRemoteTunnelHostname,
-    normalizeManagedRemoteTunnelPresets,
-    normalizeManagedRemoteTunnelPresetTokens,
     isUnsafeSkillRelativePath,
     sanitizeTypographySizesPartial,
     normalizeStringArray,

package/server/lib/opencode/settings-normalization-runtime.test.js

@@ -12,9 +12,6 @@ const createTestRuntime = (overrides = {}) => {
     },
     processLike: { platform: 'linux', env: {} },
     realpathSync: (p) => p,
-    tunnelBootstrapTtlDefaultMs: 600000,
-    tunnelBootstrapTtlMinMs: 60000,
-    tunnelBootstrapTtlMaxMs: 3600000,
     tunnelSessionTtlDefaultMs: 86400000,
     tunnelSessionTtlMinMs: 3600000,
     tunnelSessionTtlMaxMs: 604800000,

package/server/lib/opencode/settings-runtime.js

@@ -39,11 +39,6 @@ export const createSettingsRuntime = (deps) => {
     normalizeStringArray,
     formatSettingsResponse,
     resolveDirectoryCandidate,
-    normalizeManagedRemoteTunnelHostname,
-    normalizeManagedRemoteTunnelPresets,
-    normalizeManagedRemoteTunnelPresetTokens,
-    syncManagedRemoteTunnelConfigWithPresets,
-    upsertManagedRemoteTunnelToken,
   } = deps;
 
   let persistSettingsLock = Promise.resolve();
@@ -725,67 +720,6 @@ export const createSettingsRuntime = (deps) => {
     return { settings: changed ? next : settings, changed };
   };
 
-  const migrateSettingsFromLegacyNamedTunnelKeys = async (current) => {
-    const settings = current && typeof current === 'object' ? current : {};
-    const next = { ...settings };
-    let changed = false;
-
-    if (!Object.prototype.hasOwnProperty.call(next, 'managedRemoteTunnelHostname')
-      && Object.prototype.hasOwnProperty.call(next, 'namedTunnelHostname')) {
-      next.managedRemoteTunnelHostname = normalizeManagedRemoteTunnelHostname(next.namedTunnelHostname);
-      changed = true;
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(next, 'managedRemoteTunnelToken')
-      && Object.prototype.hasOwnProperty.call(next, 'namedTunnelToken')) {
-      if (next.namedTunnelToken === null) {
-        next.managedRemoteTunnelToken = null;
-      } else if (typeof next.namedTunnelToken === 'string') {
-        next.managedRemoteTunnelToken = next.namedTunnelToken.trim();
-      }
-      changed = true;
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(next, 'managedRemoteTunnelPresets')
-      && Object.prototype.hasOwnProperty.call(next, 'namedTunnelPresets')) {
-      next.managedRemoteTunnelPresets = normalizeManagedRemoteTunnelPresets(next.namedTunnelPresets);
-      changed = true;
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(next, 'managedRemoteTunnelPresetTokens')
-      && Object.prototype.hasOwnProperty.call(next, 'namedTunnelPresetTokens')) {
-      next.managedRemoteTunnelPresetTokens = normalizeManagedRemoteTunnelPresetTokens(next.namedTunnelPresetTokens);
-      changed = true;
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(next, 'managedRemoteTunnelSelectedPresetId')
-      && Object.prototype.hasOwnProperty.call(next, 'namedTunnelSelectedPresetId')) {
-      const selectedPresetId = typeof next.namedTunnelSelectedPresetId === 'string'
-        ? next.namedTunnelSelectedPresetId.trim()
-        : '';
-      if (selectedPresetId) {
-        next.managedRemoteTunnelSelectedPresetId = selectedPresetId;
-      }
-      changed = true;
-    }
-
-    const legacyKeys = [
-      'namedTunnelHostname',
-      'namedTunnelToken',
-      'namedTunnelPresets',
-      'namedTunnelPresetTokens',
-      'namedTunnelSelectedPresetId',
-    ];
-    for (const key of legacyKeys) {
-      if (Object.prototype.hasOwnProperty.call(next, key)) {
-        delete next[key];
-        changed = true;
-      }
-    }
-
-    return { settings: changed ? next : settings, changed };
-  };
-
   // `approvedDirectories` was a write-only registry: every project path and
   // visited directory was appended forever, but nothing ever read it. Strip
   // the stale key from persisted settings on upgrade.
@@ -839,21 +773,20 @@ export const createSettingsRuntime = (deps) => {
     const migration2 = await migrateSettingsFromLegacyThemePreferences(migration1.settings);
     const migration3 = await migrateSettingsFromLegacyCollapsedProjects(migration2.settings);
     const migration4 = await migrateSettingsNotificationDefaults(migration3.settings);
-    const migration5 = await migrateSettingsFromLegacyNamedTunnelKeys(migration4.settings);
-    const migration6 = normalizeSettingsPaths(migration5.settings);
-    const migration7 = await migrateSettingsToDeterministicProjectIds(migration6.settings);
-    const migration8 = migrateSettingsRemoveApprovedDirectories(migration7.settings);
-    const migration9 = migrateSettingsCompactChatDefaults(migration8.settings);
-    if (migration1.changed || migration2.changed || migration3.changed || migration4.changed || migration5.changed || migration6.changed || migration7.changed || migration8.changed || migration9.changed) {
-      await writeSettingsToDisk(migration9.settings);
-    }
-    return migration9.settings;
+    const migration5 = normalizeSettingsPaths(migration4.settings);
+    const migration6 = await migrateSettingsToDeterministicProjectIds(migration5.settings);
+    const migration7 = migrateSettingsRemoveApprovedDirectories(migration6.settings);
+    const migration8 = migrateSettingsCompactChatDefaults(migration7.settings);
+    if (migration1.changed || migration2.changed || migration3.changed || migration4.changed || migration5.changed || migration6.changed || migration7.changed || migration8.changed) {
+      await writeSettingsToDisk(migration8.settings);
+    }
+    return migration8.settings;
   };
 
   const persistSettings = async (changes) => {
     persistSettingsLock = persistSettingsLock.then(async () => {
       // Log field names only — changes can carry credentials (UI password,
-      // client tokens, tunnel tokens) that must never reach the log file.
+      // client tokens) that must never reach the log file.
       console.log('[persistSettings] Updating fields:', Object.keys(changes || {}).join(', ') || '(none)');
       const current = await readSettingsFromDisk();
       const sanitized = sanitizeSettingsUpdate(changes);
@@ -900,32 +833,6 @@ export const createSettingsRuntime = (deps) => {
         next = { ...next, activeProjectId: undefined };
       }
 
-      if (Object.prototype.hasOwnProperty.call(sanitized, 'managedRemoteTunnelPresets')) {
-        await syncManagedRemoteTunnelConfigWithPresets(next.managedRemoteTunnelPresets);
-      }
-
-      if (Object.prototype.hasOwnProperty.call(sanitized, 'managedRemoteTunnelPresetTokens') && sanitized.managedRemoteTunnelPresetTokens) {
-        const presetsById = new Map((next.managedRemoteTunnelPresets || []).map((entry) => [entry.id, entry]));
-        const updates = Object.entries(sanitized.managedRemoteTunnelPresetTokens)
-          .map(([presetId, token]) => {
-            const preset = presetsById.get(presetId);
-            if (!preset || typeof token !== 'string' || token.trim().length === 0) {
-              return null;
-            }
-            return {
-              id: preset.id,
-              name: preset.name,
-              hostname: preset.hostname,
-              token: token.trim(),
-            };
-          })
-          .filter(Boolean);
-
-        for (const update of updates) {
-          await upsertManagedRemoteTunnelToken(update);
-        }
-      }
-
       await writeSettingsToDisk(next);
       return formatSettingsResponse(next);
     });

package/server/lib/opencode/settings-runtime.test.js

@@ -21,11 +21,6 @@ const createRuntime = async () => {
     normalizeStringArray: (values) => Array.isArray(values) ? values.filter((value) => typeof value === 'string') : [],
     formatSettingsResponse: (settings) => settings,
     resolveDirectoryCandidate: (value) => value,
-    normalizeManagedRemoteTunnelHostname: (value) => value,
-    normalizeManagedRemoteTunnelPresets: (value) => value,
-    normalizeManagedRemoteTunnelPresetTokens: (value) => value,
-    syncManagedRemoteTunnelConfigWithPresets: async () => {},
-    upsertManagedRemoteTunnelToken: async () => {},
   });
 
   return {
@@ -218,11 +213,6 @@ describe('settings runtime', () => {
       normalizeStringArray: (values) => Array.isArray(values) ? values.filter((value) => typeof value === 'string') : [],
       formatSettingsResponse: (settings) => settings,
       resolveDirectoryCandidate: (value) => value,
-      normalizeManagedRemoteTunnelHostname: (value) => value,
-      normalizeManagedRemoteTunnelPresets: (value) => value,
-      normalizeManagedRemoteTunnelPresetTokens: (value) => value,
-      syncManagedRemoteTunnelConfigWithPresets: async () => {},
-      upsertManagedRemoteTunnelToken: async () => {},
     });
 
     try {

package/server/lib/opencode/shutdown-runtime.js

@@ -27,8 +27,6 @@ export const createGracefulShutdownRuntime = (dependencies) => {
     getServer,
     getUiAuthController,
     setUiAuthController,
-    getActiveTunnelController,
-    setActiveTunnelController,
     tunnelAuthController,
     closeFeatureRoutes,
   } = dependencies;
@@ -135,13 +133,7 @@ export const createGracefulShutdownRuntime = (dependencies) => {
       setUiAuthController(null);
     }
 
-    const activeTunnelController = getActiveTunnelController();
-    if (activeTunnelController) {
-      console.log('Stopping active tunnel...');
-      activeTunnelController.stop();
-      setActiveTunnelController(null);
-      tunnelAuthController.clearActiveTunnel();
-    }
+    tunnelAuthController?.clearActiveTunnel?.();
 
     console.log('Graceful shutdown complete');
     if (exitProcess) {

package/server/lib/opencode/shutdown-runtime.test.js

@@ -27,8 +27,6 @@ const createRuntime = (server, shutdownTimeoutMs = 1000, overrides = {}) => crea
   getServer: () => server,
   getUiAuthController: () => null,
   setUiAuthController: vi.fn(),
-  getActiveTunnelController: () => null,
-  setActiveTunnelController: vi.fn(),
   tunnelAuthController: { clearActiveTunnel: vi.fn() },
   ...overrides,
 });

package/server/lib/opencode/startup-pipeline-runtime.js

@@ -35,22 +35,12 @@ export const createStartupPipelineRuntime = (dependencies) => {
       setManagedOpenCodeBridgeOrigin,
       staticRoutesRuntime,
       process,
-      crypto,
-      normalizeTunnelBootstrapTtlMs,
-      readSettingsFromDiskMigrated,
-      tunnelAuthController,
-      startTunnelWithNormalizedRequest,
       gracefulShutdown,
       getSignalsAttached,
       setSignalsAttached,
       syncToHmrState,
-      TUNNEL_MODE_QUICK,
-      TUNNEL_MODE_MANAGED_LOCAL,
-      TUNNEL_MODE_MANAGED_REMOTE,
       host,
       port,
-      startupTunnelRequest,
-      onTunnelReady,
       tunnelRuntimeContext,
       attachSignals,
       apiOnly,
@@ -109,27 +99,17 @@ export const createStartupPipelineRuntime = (dependencies) => {
 
     const serverStartupRuntime = createServerStartupRuntime({
       process,
-      crypto,
       server,
-      normalizeTunnelBootstrapTtlMs,
-      readSettingsFromDiskMigrated,
-      tunnelAuthController,
-      startTunnelWithNormalizedRequest,
       gracefulShutdown,
       getSignalsAttached,
       setSignalsAttached,
       syncToHmrState,
-      TUNNEL_MODE_QUICK,
-      TUNNEL_MODE_MANAGED_LOCAL,
-      TUNNEL_MODE_MANAGED_REMOTE,
     });
 
     const bindHost = serverStartupRuntime.resolveBindHost(host);
     const startupResult = await serverStartupRuntime.startListeningAndMaybeTunnel({
       port,
       bindHost,
-      startupTunnelRequest,
-      onTunnelReady,
     });
     tunnelRuntimeContext.setActivePort(startupResult.activePort);
     if (typeof setManagedOpenCodeBridgeOrigin === 'function') {

package/server/lib/opencode/startup-pipeline-runtime.test.js

@@ -13,9 +13,8 @@ describe('startup pipeline runtime', () => {
       isRequestOriginAllowed: () => true, rejectWebSocketUpgrade: () => {}, buildOpenCodeUrl: () => '', getOpenCodeAuthHeaders: () => ({}), globalEventHub: {}, processForwardedEventPayload: () => {}, messageStreamWsClients: new Set(), triggerHealthCheck: () => {}, upstreamStallTimeoutMs: 1,
       terminalHeartbeatIntervalMs: 1, terminalRebindWindowMs: 1, terminalMaxRebindsPerWindow: 1, setupProxy: () => {}, scheduleOpenCodeApiDetection: () => {},
       bootstrapOpenCodeAtStartup: () => { order.push('bootstrap'); }, setManagedOpenCodeBridgeOrigin: (origin) => { order.push(origin); },
-      staticRoutesRuntime: { registerStaticRoutes: () => {}, registerApiOnlyFallbackRoutes: () => {} }, process: {}, crypto: {}, normalizeTunnelBootstrapTtlMs: () => 1,
-      readSettingsFromDiskMigrated: async () => ({}), tunnelAuthController: {}, startTunnelWithNormalizedRequest: () => {}, gracefulShutdown: () => {}, getSignalsAttached: () => false, setSignalsAttached: () => {}, syncToHmrState: () => {},
-      TUNNEL_MODE_QUICK: 'quick', TUNNEL_MODE_MANAGED_LOCAL: 'local', TUNNEL_MODE_MANAGED_REMOTE: 'remote', host: '127.0.0.1', port: 0, startupTunnelRequest: null, onTunnelReady: () => {}, tunnelRuntimeContext: { setActivePort: () => {} }, attachSignals: false, apiOnly: false, dictationModelsDir: '',
+      staticRoutesRuntime: { registerStaticRoutes: () => {}, registerApiOnlyFallbackRoutes: () => {} }, process: {}, gracefulShutdown: () => {}, getSignalsAttached: () => false, setSignalsAttached: () => {}, syncToHmrState: () => {},
+      host: '127.0.0.1', port: 0, tunnelRuntimeContext: { setActivePort: () => {} }, attachSignals: false, apiOnly: false, dictationModelsDir: '',
     });
     expect(order).toEqual(['http://127.0.0.1:41234', 'bootstrap']);
   });