@rubytech/create-maxy-code 0.1.109 → 0.1.110

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -1,852 +0,0 @@
-#!/usr/bin/env bash
-# Deterministic Cloudflare tunnel setup — mirrors
-# platform/plugins/cloudflare/references/manual-setup.md step-by-step.
-# Brand-scoped paths, user-space systemd, apex-aware.
-#
-# Usage:
-#   setup-tunnel.sh <brand> <port> <hostname> [<hostname> ...]
-#
-# Example:
-#   setup-tunnel.sh maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat
-#
-# Apex hostnames (exactly two DNS labels) cannot have their CNAMEs created
-# via `cloudflared tunnel route dns` — see manual-setup.md §Step 4 Apex
-# hostnames. The script writes the ingress rule for them but prints an
-# explicit ACTION REQUIRED message naming the manual dashboard step.
-#
-# Step 1 surfaces the argotunnel URL on stdout as an `OAUTH_URL:` line. The
-# native Claude Code PTY linkifies bare URLs so the operator clicks it from
-# their admin chat directly. The script spawns no browser of its own.
-# cloudflared's stdout+stderr stream verbatim into the PTY chat alongside
-# the script's own `[setup-tunnel] step=<phase> …` phase lines.
-
-set -euo pipefail
-
-# Resolve symlinks before dirname — ~/setup-tunnel.sh is installed as a symlink
-# (see packages/create-maxy-code/src/index.ts:installTunnelScripts), so the raw
-# BASH_SOURCE[0] points at $HOME, not the scripts directory where the sibling
-# helper (tunnel-ingress.ts) lives.
-SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
-
-# --------------------------------------------------------------------------
-# Phase-line helper. Stream-log plumbing retired in Task 287 — every
-# observation goes straight to stdout for the PTY to render. Format is
-# `[<scope>] <key>=<value> …` to keep operator-grep parity with the prior
-# `[<scope>] phase=…` shape that the now-deleted _stream-log.sh emitted.
-# --------------------------------------------------------------------------
-
-phase_line() {
-  local scope=$1
-  shift
-  printf '[%s] %s\n' "${scope}" "$*"
-}
-
-# --------------------------------------------------------------------------
-# Args
-# --------------------------------------------------------------------------
-
-if [ "$#" -lt 3 ]; then
-  echo "Usage: $0 <brand> <port> <hostname> [<hostname> ...]" >&2
-  echo "Example: $0 maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat" >&2
-  exit 2
-fi
-
-BRAND="$1"
-PORT="$2"
-shift 2
-HOSTNAMES=("$@")
-
-# --------------------------------------------------------------------------
-# SSH/SMB ingress env vars.
-#
-# SSH and SMB hostnames arrive via environment, NOT positional argv, so the
-# existing form/endpoint contract (which passes admin/public/apex as
-# positionals) keeps working unchanged. The action-runner sets these env
-# vars when the operator submits the cloudflare-setup form with the SSH
-# and SMB fields populated; absent env vars mean "no SSH/SMB ingress this
-# run" — except when tunnel.state already persists them, in which case
-# rehydrate from there.
-#
-#   SSH_HOSTNAME      e.g. ssh.maxy.bot   → ingress service: ssh://localhost:22
-#   SMB_HOSTNAME      e.g. smb.maxy.bot   → ingress service: tcp://localhost:445
-#   OPERATOR_EMAIL    e.g. joel@x.com     → printed in the ACTION REQUIRED
-#                                            dashboard click-path for the
-#                                            Access policy (operator-authored;
-#                                            CF API is banned per
-#                                            feedback_cf_api_total_eradication)
-#
-# Re-run idempotency: if env vars are unset, the script reads sshHostname /
-# smbHostname from the existing tunnel.state (if present) so a re-run
-# without env vars doesn't silently drop the SSH/SMB ingress. tunnel.state
-# is rewritten with the resolved hostnames at the end of Step 5b.
-# --------------------------------------------------------------------------
-
-SSH_HOSTNAME="${SSH_HOSTNAME:-}"
-SMB_HOSTNAME="${SMB_HOSTNAME:-}"
-OPERATOR_EMAIL="${OPERATOR_EMAIL:-}"
-SETUP_TUNNEL_DRY_RUN="${SETUP_TUNNEL_DRY_RUN:-0}"
-
-phase_line setup-tunnel step=start brand="${BRAND}" port="${PORT}" hostnames="${HOSTNAMES[*]}" \
-  ssh_hostname="${SSH_HOSTNAME:-none}" smb_hostname="${SMB_HOSTNAME:-none}" \
-  dry_run="${SETUP_TUNNEL_DRY_RUN}"
-
-# --------------------------------------------------------------------------
-# Step 0: Set brand context (paths + dirs). Corresponds to runbook Step 0.
-# --------------------------------------------------------------------------
-
-CFG_DIR="${HOME}/.${BRAND}/cloudflared"
-mkdir -p "${CFG_DIR}"
-
-# brand.json path resolution. Step 5b reads `.operatorEmail` from this file
-# when OPERATOR_EMAIL is not in env; absent file is a tolerated no-op.
-SETUP_TUNNEL_BRAND_JSON=""
-if [ -n "${MAXY_PLATFORM_ROOT:-}" ] && [ -f "${MAXY_PLATFORM_ROOT}/config/brand.json" ]; then
-  SETUP_TUNNEL_BRAND_JSON="${MAXY_PLATFORM_ROOT}/config/brand.json"
-fi
-
-# --------------------------------------------------------------------------
-# Step 1: OAuth login. Corresponds to runbook Step 1.
-#
-# Step 1 is a state machine over two observable variables — brand-scoped
-# cert path and default cert path:
-#
-#   ${CFG_DIR}/cert.pem present                   → Step 1 already done; skip.
-#   ${CFG_DIR}/cert.pem missing                AND
-#     ~/.cloudflared/cert.pem present             → pre-flight: a prior run
-#                                                   reached the OAuth callback
-#                                                   but failed before the mv;
-#                                                   promote and skip cloudflared.
-#   both missing                                  → spawn cloudflared, surface
-#                                                   the OAuth URL on stdout for
-#                                                   the admin UI to render as a
-#                                                   clickable link, poll for
-#                                                   cert.pem, mv.
-#
-# Control flow when both certs are missing:
-#   1. Spawn cloudflared; its stdout+stderr stream into the PTY via stderr
-#      prefixed with `[script:setup-tunnel:cloudflared]`.
-#   2. Extract the authorize URL with a tolerant regex as it streams.
-#   3. Print the URL on stdout as `OAUTH_URL: <url>` — the native Claude
-#      Code PTY linkifies it. The script does not spawn a browser; the
-#      operator's local browser is the canonical surface. cloudflared's
-#      OAuth callback writes ~/.cloudflared/cert.pem regardless of which
-#      browser completed the Authorize click (it's a server-to-server poll
-#      against login.cloudflareaccess.org).
-#   4. Wait for ~/.cloudflared/cert.pem to land (180 s budget — operator
-#      must click the link and Authorize on Cloudflare).
-#   5. Move cert.pem into the brand-scoped path.
-#
-# Every failure branch exits 1 loudly naming the cause.
-# --------------------------------------------------------------------------
-
-# Pre-flight cert-promotion. When ${CFG_DIR}/cert.pem is missing
-# but the OAuth-default ~/.cloudflared/cert.pem is present, a prior run
-# reached the cloudflared callback but did not survive to the brand-scoped
-# mv at the end of Step 1. The cert is bound to the account already; the
-# only remediation is the move. Doing it before re-spawning cloudflared is
-# what stops Step 1 from looping forever on a dashboard that has moved past
-# a button-bearing state.
-#
-# The mv exit code is checked: if it fails (EACCES, ENOSPC, weird FS state),
-# loud-fail with reason=cert-promote-failed instead of pretending Step 1
-# succeeded — the next steps would die opaquely on the missing brand cert.
-# stderr is captured into the phase_line so the operator sees the actual
-# failure cause (mv exit-code 1 alone cannot disambiguate EACCES from ENOSPC).
-if [ ! -f "${CFG_DIR}/cert.pem" ] && [ -f "${HOME}/.cloudflared/cert.pem" ]; then
-  MV_ERR="$(mktemp -t maxy-cert-promote-err.XXXXXX)"
-  if mv "${HOME}/.cloudflared/cert.pem" "${CFG_DIR}/cert.pem" 2>"${MV_ERR}"; then
-    rm -f "${MV_ERR}"
-    phase_line setup-tunnel step=oauth-login result=ok \
-      reason=cert-promoted-from-default-path waited="0s"
-  else
-    MV_RC=$?
-    MV_STDERR="$(tr '\n' ' ' < "${MV_ERR}" 2>/dev/null | head -c 200 || echo unavailable)"
-    rm -f "${MV_ERR}"
-    phase_line setup-tunnel step=oauth-login result=error \
-      reason=cert-promote-failed mv_rc="${MV_RC}" stderr="${MV_STDERR}" \
-      from="${HOME}/.cloudflared/cert.pem" to="${CFG_DIR}/cert.pem"
-    echo "ERROR: failed to promote ~/.cloudflared/cert.pem to ${CFG_DIR}/cert.pem (mv exit=${MV_RC})." >&2
-    echo "       mv stderr: ${MV_STDERR}" >&2
-    echo "       Step 1 cannot proceed without the cert in the brand-scoped path." >&2
-    exit 1
-  fi
-fi
-
-if [ ! -f "${CFG_DIR}/cert.pem" ]; then
-  phase_line setup-tunnel step=oauth-login cert_path="${CFG_DIR}/cert.pem"
-
-  URL_FILE="$(mktemp -t maxy-setup-tunnel-url.XXXXXX)"
-  LAST_LINE_FILE="$(mktemp -t maxy-setup-tunnel-last.XXXXXX)"
-  : > "${URL_FILE}"
-  : > "${LAST_LINE_FILE}"
-  # Track the cloudflared pipeline PID so the EXIT trap can kill it on any
-  # failure path — including ones that `exit 1` without an explicit kill.
-  # Missing this trap leaks a cloudflared subshell waiting for the OAuth
-  # callback forever; subsequent setup-tunnel runs see a stale cert.pem
-  # landing asynchronously and race against the new URL-extraction pass.
-  CF_PIPELINE_PID=""
-  cleanup_oauth() {
-    [ -n "${CF_PIPELINE_PID}" ] && kill "${CF_PIPELINE_PID}" 2>/dev/null || true
-    rm -f "${URL_FILE}" "${LAST_LINE_FILE}"
-  }
-  trap cleanup_oauth EXIT
-
-  # cloudflared is line-buffered (stdbuf); each line is echoed verbatim into
-  # the PTY (stderr) while the OAuth URL is also extracted as it streams.
-  # The subshell holds the whole pipeline so PIPESTATUS[0] (cloudflared's
-  # exit code) is reachable later.
-  (
-    stdbuf -oL -eL cloudflared \
-      --origincert "${CFG_DIR}/cert.pem" tunnel login 2>&1 |
-      while IFS= read -r line; do
-        printf '[script:setup-tunnel:cloudflared] %s\n' "${line}" >&2
-        printf '%s\n' "${line}" > "${LAST_LINE_FILE}"
-        if [ ! -s "${URL_FILE}" ]; then
-          url="$(printf '%s' "${line}" | grep -oE 'https://dash\.cloudflare\.com/argotunnel\?[^ ]+' | head -1 || true)"
-          if [ -n "${url}" ]; then
-            printf '%s' "${url}" > "${URL_FILE}"
-          fi
-        fi
-      done
-  ) &
-  CF_PIPELINE_PID=$!
-
-  # Wait up to ~15s for the URL to surface in cloudflared's output.
-  URL_WAIT=0
-  while [ ! -s "${URL_FILE}" ] && [ "${URL_WAIT}" -lt 30 ]; do
-    if ! kill -0 "${CF_PIPELINE_PID}" 2>/dev/null; then
-      phase_line setup-tunnel step=oauth-login result=error \
-        reason=cloudflared-exited-before-url \
-        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
-      echo "ERROR: cloudflared exited before printing the authorize URL." >&2
-      exit 1
-    fi
-    sleep 0.5
-    URL_WAIT=$((URL_WAIT + 1))
-  done
-
-  if [ ! -s "${URL_FILE}" ]; then
-    kill "${CF_PIPELINE_PID}" 2>/dev/null || true
-    phase_line setup-tunnel step=oauth-login result=error \
-      reason=url-not-extracted waited=15s \
-      last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
-    echo "ERROR: cloudflared ran for ~15s without emitting a dash.cloudflare.com/argotunnel URL." >&2
-    echo "       cloudflared output-format may have changed. Check the stream log tail for the raw lines." >&2
-    exit 1
-  fi
-
-  AUTH_URL="$(cat "${URL_FILE}")"
-  phase_line setup-tunnel step=oauth-url-extracted url_extracted=1
-
-  # Emit the URL on stdout in a shape the PTY linkifies natively.
-  # The native Claude Code terminal renderer turns bare URLs into clicks so
-  # the operator authorizes Cloudflare in the same browser they are using
-  # for the admin chat. The script does not spawn a browser of its own.
-  printf 'OAUTH_URL: %s\n' "${AUTH_URL}"
-
-  # Wait for cert.pem to land — cloudflared writes to ~/.cloudflared/cert.pem
-  # regardless of --origincert, so watch the canonical location. The wait is
-  # human-paced: the operator must click the link and Authorize on Cloudflare.
-  # 180 s default budget; SETUP_TUNNEL_LOGIN_TIMEOUT overrides for testing.
-  # The 2-second heartbeat inside the loop is the observability contract —
-  # no form-spawned script is allowed a silent poll of more than ~2 s.
-  LOGIN_TIMEOUT="${SETUP_TUNNEL_LOGIN_TIMEOUT:-180}"
-  LOGIN_WAIT=0
-  while [ ! -f "${HOME}/.cloudflared/cert.pem" ]; do
-    if ! kill -0 "${CF_PIPELINE_PID}" 2>/dev/null; then
-      # Pipeline exited — one more cert.pem probe in case it landed right before exit.
-      if [ -f "${HOME}/.cloudflared/cert.pem" ]; then break; fi
-      phase_line setup-tunnel step=oauth-login result=error \
-        reason=cloudflared-exited-no-cert \
-        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
-      echo "ERROR: cloudflared exited before cert.pem landed." >&2
-      exit 1
-    fi
-    if [ "${LOGIN_WAIT}" -ge "${LOGIN_TIMEOUT}" ]; then
-      kill "${CF_PIPELINE_PID}" 2>/dev/null || true
-      phase_line setup-tunnel step=oauth-login result=error \
-        reason=timeout-waiting-cert waited="${LOGIN_WAIT}s" \
-        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
-      echo "ERROR: Timed out after ${LOGIN_WAIT}s waiting for cert.pem to land." >&2
-      exit 1
-    fi
-    # Heartbeat every 2 s. t=0 is the oauth-url-extracted phase line above;
-    # the first heartbeat fires at t=2. Without this line the tailer sees
-    # silence for the full 1-20 s round-trip — the exact state the heartbeat
-    # contract forbids.
-    if [ "${LOGIN_WAIT}" -gt 0 ] && [ $((LOGIN_WAIT % 2)) -eq 0 ]; then
-      phase_line setup-tunnel step=oauth-login result=awaiting-cert \
-        elapsed="${LOGIN_WAIT}s" timeout="${LOGIN_TIMEOUT}s"
-    fi
-    sleep 1
-    LOGIN_WAIT=$((LOGIN_WAIT + 1))
-  done
-
-  mv "${HOME}/.cloudflared/cert.pem" "${CFG_DIR}/cert.pem"
-  phase_line setup-tunnel step=oauth-login result=ok \
-    path="${CFG_DIR}/cert.pem" waited="${LOGIN_WAIT}s"
-fi
-
-# --------------------------------------------------------------------------
-# Step 2+3: Resolve the tunnel identity from operator input.
-#
-# The local hostname has no authority over which tunnel the operator's
-# logged-in Cloudflare account holds. Deriving TUNNEL_NAME locally (e.g.
-# "${BRAND}-$(hostname -s)") and reusing-or-creating it produces a new
-# tunnel when the device is renamed while existing CNAMEs continue to
-# point at the old one.
-#
-# Contract: the operator's logged-in Cloudflare account is the source of
-# truth. The agent enumerates existing tunnels via `cloudflared tunnel list
-# --output json` (presented in chat as a numbered list) and then invokes
-# this script with exactly one of:
-#   TUNNEL_ID   — operator selected an existing tunnel from the list
-#   TUNNEL_NAME — operator typed a name to create a new tunnel
-# Setting both, or neither, is a misuse.
-# --------------------------------------------------------------------------
-
-if [ -n "${TUNNEL_ID:-}" ] && [ -n "${TUNNEL_NAME:-}" ]; then
-  phase_line setup-tunnel step=tunnel-resolve result=error reason=both-set
-  echo "ERROR: TUNNEL_ID and TUNNEL_NAME are mutually exclusive — pass exactly one." >&2
-  exit 1
-fi
-if [ -z "${TUNNEL_ID:-}" ] && [ -z "${TUNNEL_NAME:-}" ]; then
-  phase_line setup-tunnel step=tunnel-resolve result=error reason=neither-set
-  echo "ERROR: TUNNEL_ID (selected) or TUNNEL_NAME (explicit-create) is required." >&2
-  echo "       The agent enumerates existing tunnels via" >&2
-  echo "       'cloudflared tunnel list --output json' and passes one of" >&2
-  echo "       these env vars on invocation. Do not invoke this script" >&2
-  echo "       directly without one of them set." >&2
-  exit 1
-fi
-
-if [ -n "${TUNNEL_ID:-}" ]; then
-  # Operator-selected branch. Resolve the name back from `tunnel list` for
-  # the log line + tunnel.state file. A missing row here means the operator
-  # selected a tunnel that has since been deleted from another surface
-  # (rare but possible) — fail loudly so the operator sees the cause
-  # rather than getting a silent fallback to "create new".
-  TUNNEL_NAME="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json 2>/dev/null \
-    | jq -r --arg I "${TUNNEL_ID}" '.[]? | select(.id == $I) | .name' | head -1)"
-  if [ -z "${TUNNEL_NAME}" ] || [ "${TUNNEL_NAME}" = "null" ]; then
-    phase_line setup-tunnel step=tunnel-resolve result=error \
-      reason=selected-tunnel-not-found tunnel_id="${TUNNEL_ID}"
-    echo "ERROR: TUNNEL_ID ${TUNNEL_ID} is not on the logged-in Cloudflare account." >&2
-    echo "       It may have been deleted from the dashboard since the form loaded." >&2
-    echo "       Re-render the form to refresh the tunnel list." >&2
-    exit 1
-  fi
-  TUNNEL_SOURCE="operator-selected"
-else
-  # Operator-create branch. Refuse to silently reuse an existing tunnel of
-  # the same name — silent reuse hides which tunnel CNAMEs actually point
-  # at. The operator should have picked it from the list.
-  EXISTING_ID="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json 2>/dev/null \
-    | jq -r --arg N "${TUNNEL_NAME}" '.[]? | select(.name == $N) | .id' | head -1)"
-  if [ -n "${EXISTING_ID}" ] && [ "${EXISTING_ID}" != "null" ]; then
-    phase_line setup-tunnel step=tunnel-resolve result=error \
-      reason=name-already-exists tunnel_name="${TUNNEL_NAME}" tunnel_id="${EXISTING_ID}"
-    echo "ERROR: a tunnel named ${TUNNEL_NAME} already exists (id=${EXISTING_ID})." >&2
-    echo "       Re-render the form and select it from the list, or pick a different name." >&2
-    exit 1
-  fi
-  cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel create "${TUNNEL_NAME}"
-  TUNNEL_ID="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json \
-    | jq -r --arg N "${TUNNEL_NAME}" '.[]? | select(.name == $N) | .id' | head -1)"
-  if [ -z "${TUNNEL_ID}" ] || [ "${TUNNEL_ID}" = "null" ]; then
-    phase_line setup-tunnel step=tunnel-resolve result=error \
-      reason=create-then-uuid-missing tunnel_name="${TUNNEL_NAME}"
-    echo "ERROR: created tunnel ${TUNNEL_NAME} but its UUID is missing from tunnel list." >&2
-    exit 1
-  fi
-  TUNNEL_SOURCE="operator-created"
-fi
-phase_line setup-tunnel step=tunnel-resolve source="${TUNNEL_SOURCE}" \
-  tunnel_id="${TUNNEL_ID}" tunnel_name="${TUNNEL_NAME}"
-echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
-
-# --------------------------------------------------------------------------
-# Step 3b: Zone pre-flight. Before routing DNS, verify every non-apex
-# hostname's registrable parent (last two labels, e.g. rogerblack.maxy.bot
-# → maxy.bot) has NS records pointing at Cloudflare. If any hostname's
-# parent zone is not on Cloudflare, refuse the whole run before calling
-# `cloudflared tunnel route dns`.
-#
-# DESIGN NOTE — what this catches and what it does NOT catch:
-#   CATCHES: parent zone does not exist, or its NS records do not point
-#     at Cloudflare's nameservers. Pre-529 the shell relied on a post-
-#     flight sed of cloudflared's stdout for this defence
-#     deletes that parser because it rejects the idempotent no-op output
-#     shape (session 25674fe3) and replaces it with this inline NS probe.
-#     Same primitive the MCP path uses in
-#     cloudflared.ts::checkZoneParentOnCloudflare.
-#   DOES NOT CATCH: the zone is on Cloudflare but on a DIFFERENT account
-#     than the one cert.pem is bound to. A true account-zone-list check
-#     requires either a cloudflared CLI zone-list subcommand (does not
-#     exist as of 2026-04) or persisting the bound account's zones at
-#     tunnel-login time (deferred — separate task). The wrong-account
-#     case is detected post-hoc by tunnel-status's hostname probe, not
-#     here. This is an explicitly accepted gap per the scope.
-#
-# Probe uses 1.1.1.1 directly to bypass the device's local resolver
-# (matching Resolver.setServers in the MCP path) — avoids cache /
-# split-horizon issues on the Pi.
-# --------------------------------------------------------------------------
-
-is_apex() {
-  local h="$1"
-  # Apex heuristic: exactly one dot (e.g. maxy.chat). Breaks for
-  # multi-label public suffixes like .co.uk; refine if needed.
-  [ "$(echo -n "$h" | tr -cd '.' | wc -c)" = "1" ]
-}
-
-registrable_parent() {
-  local h="$1"
-  local labels n
-  IFS='.' read -ra labels <<< "${h}"
-  n=${#labels[@]}
-  if [ "${n}" -le 2 ]; then
-    printf '%s' "${h}"
-  else
-    printf '%s.%s' "${labels[$((n-2))]}" "${labels[$((n-1))]}"
-  fi
-}
-
-if ! command -v dig >/dev/null 2>&1; then
-  phase_line setup-tunnel step=zone-preflight result=error \
-    reason=dig-missing
-  echo "ERROR: dig is not in PATH — required for the zone pre-flight check." >&2
-  echo "       Re-run the Maxy installer to reprovision DNS tooling (bind9-dnsutils)." >&2
-  exit 1
-fi
-
-ZONES_SEEN=""
-MISSING_PARENT=""
-for H in "${HOSTNAMES[@]}"; do
-  if is_apex "$H"; then continue; fi
-  ZONE="$(registrable_parent "$H")"
-  NS_OUT="$(dig +short +time=3 +tries=1 NS "${ZONE}" @1.1.1.1 2>/dev/null || true)"
-  if printf '%s' "${NS_OUT}" | grep -qiE '\.ns\.cloudflare\.com\.?$'; then
-    case ",${ZONES_SEEN}," in
-      *",${ZONE},"*) ;;
-      *) ZONES_SEEN="${ZONES_SEEN:+${ZONES_SEEN},}${ZONE}" ;;
-    esac
-  else
-    MISSING_PARENT="${H}"
-    break
-  fi
-done
-
-if [ -n "${MISSING_PARENT}" ]; then
-  MISSING_ZONE="$(registrable_parent "${MISSING_PARENT}")"
-  phase_line setup-tunnel step=zone-preflight result=error \
-    missing_parent_for="${MISSING_PARENT}" \
-    zones_on_account="${ZONES_SEEN}"
-  echo "" >&2
-  echo "ERROR: cannot route ${MISSING_PARENT} — its parent zone ${MISSING_ZONE}" >&2
-  echo "       is not on Cloudflare (NS records do not point at *.ns.cloudflare.com)." >&2
-  echo "       Zones confirmed on Cloudflare so far: ${ZONES_SEEN:-none}" >&2
-  echo "" >&2
-  echo "       Fix: sign into the Cloudflare account that owns ${MISSING_ZONE}" >&2
-  echo "         1. ~/reset-tunnel.sh        # clear cert.pem and tunnel state" >&2
-  echo "         2. ~/setup-tunnel.sh ...    # re-run while signed into the correct account" >&2
-  exit 1
-fi
-
-phase_line setup-tunnel step=zone-preflight result=ok \
-  zones_on_account="${ZONES_SEEN}"
-
-# --------------------------------------------------------------------------
-# Step 4: Route DNS. Apex hostnames (exactly two DNS labels) cannot be
-# routed via `cloudflared tunnel route dns` — it misroutes them into
-# another zone on the account. Skip CLI routing for apex; collect for the
-# ACTION REQUIRED summary at the end.
-#
-# Control flow: cloudflared's exit code is the sole decision
-# signal. No stdout parsing. `cloudflared tunnel route dns --overwrite-dns`
-# exits 0 on every legitimate outcome (create, overwrite, already-correct
-# no-op) and non-zero on every legitimate failure. The pre-flight above
-# already refused if the parent zone is not on Cloudflare; the post-flight
-# parser the shell historically carried (deleted in 559) rejected the
-# idempotent no-op output shape `INF <h> is already configured to
-# route...` and caused session 25674fe3 to die after cloudflared exited 0.
-# --------------------------------------------------------------------------
-
-APEX_HOSTNAMES=()
-for H in "${HOSTNAMES[@]}"; do
-  if is_apex "$H"; then
-    APEX_HOSTNAMES+=("$H")
-    phase_line setup-tunnel step=route-dns hostname="${H}" result=apex-skip
-    echo "apex ${H} — skipping CLI DNS routing (manual dashboard step required)"
-    continue
-  fi
-
-  phase_line setup-tunnel step=route-dns hostname="${H}" tunnel_id="${TUNNEL_ID}"
-  ROUTE_LOG="$(mktemp -t maxy-route-dns.XXXXXX)"
-  # tee_subprocess_capture streams cloudflared's combined stdout+stderr
-  # into STREAM_LOG_PATH line-by-line with the [script:setup-tunnel:cloudflared]
-  # tag (live-tailable chat-surface namespace) AND passes the same output through this shell's
-  # stdout so the `> "${ROUTE_LOG}"` redirection can capture it for the
-  # failure-path phase_line. Exit code is cloudflared's PIPESTATUS[0].
-  if tee_subprocess_capture setup-tunnel:cloudflared -- \
-      cloudflared --origincert "${CFG_DIR}/cert.pem" \
-      tunnel route dns --overwrite-dns "${TUNNEL_ID}" "${H}" \
-      > "${ROUTE_LOG}"; then
-    phase_line setup-tunnel step=route-dns hostname="${H}" result=ok
-  else
-    ROUTE_RC=$?
-    STDERR_BOUNDED="$(tr '\n' ' ' < "${ROUTE_LOG}" | head -c 400)"
-    phase_line setup-tunnel step=route-dns hostname="${H}" result=error \
-      exit="${ROUTE_RC}" stderr="${STDERR_BOUNDED}"
-    echo "ERROR: cloudflared tunnel route dns failed for ${H} (exit=${ROUTE_RC})" >&2
-    echo "       stderr: ${STDERR_BOUNDED}" >&2
-    rm -f "${ROUTE_LOG}"
-    exit 1
-  fi
-  rm -f "${ROUTE_LOG}"
-done
-
-# --------------------------------------------------------------------------
-# Rehydrate SSH/SMB hostnames from tunnel.state when env unset.
-#
-# A re-run without SSH_HOSTNAME / SMB_HOSTNAME should keep the previously
-# configured ingress rather than silently dropping them. The Node helper
-# reads tunnel.state (if present) and prints a JSON {sshHostname, smbHostname}.
-# --------------------------------------------------------------------------
-
-TUNNEL_INGRESS_TS="${SCRIPT_DIR}/tunnel-ingress.ts"
-if [ ! -f "${TUNNEL_INGRESS_TS}" ]; then
-  phase_line setup-tunnel step=ingress-renderer-resolve result=error \
-    reason=helper-missing path="${TUNNEL_INGRESS_TS}"
-  echo "ERROR: tunnel-ingress.ts is missing at ${TUNNEL_INGRESS_TS}" >&2
-  exit 1
-fi
-
-if [ -z "${SSH_HOSTNAME}${SMB_HOSTNAME}" ] && [ -f "${CFG_DIR}/tunnel.state" ]; then
-  PERSISTED_JSON="$(node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" read-state "${CFG_DIR}/tunnel.state" 2>/dev/null || echo '{}')"
-  PERSISTED_SSH="$(printf '%s' "${PERSISTED_JSON}" | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d);process.stdout.write(o.sshHostname||"")}catch{}})')"
-  PERSISTED_SMB="$(printf '%s' "${PERSISTED_JSON}" | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d);process.stdout.write(o.smbHostname||"")}catch{}})')"
-  if [ -n "${PERSISTED_SSH}" ]; then
-    SSH_HOSTNAME="${PERSISTED_SSH}"
-    phase_line setup-tunnel step=ssh-hostname-rehydrated hostname="${SSH_HOSTNAME}"
-  fi
-  if [ -n "${PERSISTED_SMB}" ]; then
-    SMB_HOSTNAME="${PERSISTED_SMB}"
-    phase_line setup-tunnel step=smb-hostname-rehydrated hostname="${SMB_HOSTNAME}"
-  fi
-fi
-
-# --------------------------------------------------------------------------
-# Samba presence probe (gates SMB ingress stanza).
-#
-#, the brand's Samba stanza `[<brand>]` is written to
-# /etc/samba/smb.conf at install time. If the stanza is absent, this Pi
-# has no SMB share to expose and the SMB ingress is skipped loudly.
-# Probe via grep on the Pi filesystem (NOT brand.json — Samba is a
-# post-install side effect, not a declared field).
-# --------------------------------------------------------------------------
-
-if [ -n "${SMB_HOSTNAME}" ]; then
-  if ! node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" probe-samba "${BRAND}" /etc/samba/smb.conf >/dev/null 2>&1; then
-    phase_line setup-tunnel step=smb-ingress-skipped reason=samba-not-provisioned \
-      hostname="${SMB_HOSTNAME}" brand="${BRAND}"
-    echo "[tunnel-install] smb-ingress-skipped reason=samba-not-provisioned brand=${BRAND}"
-    echo "  Skipping SMB ingress: /etc/samba/smb.conf has no [${BRAND}] stanza."
-    echo "  Provision Samba first (the installer's post-install step does this); then re-run."
-    SMB_HOSTNAME=""
-  fi
-fi
-
-# --------------------------------------------------------------------------
-# Step 4b: Route DNS for SSH/SMB hostnames (after HTTPS pass).
-#
-# Two-phase ordering: HTTPS hostnames are routed first (loop above). If a
-# subsequent SSH or SMB route DNS fails, emit `*-ingress-deferred` and
-# continue WITHOUT exit 1, so the HTTPS ingress remains durable. Apex
-# hostnames are not valid for SSH/SMB (the hostnames are subdomains by
-# definition); no apex carve-out is needed.
-# --------------------------------------------------------------------------
-
-route_extra_hostname() {
-  local kind="$1"  # "ssh" or "smb"
-  local hostname="$2"
-  [ -z "${hostname}" ] && return 0
-
-  if [ "${SETUP_TUNNEL_DRY_RUN}" = "1" ]; then
-    phase_line setup-tunnel step="${kind}-route-dns" hostname="${hostname}" result=dry-run-skip
-    return 0
-  fi
-
-  phase_line setup-tunnel step="${kind}-route-dns" hostname="${hostname}" tunnel_id="${TUNNEL_ID}"
-  local ROUTE_LOG
-  ROUTE_LOG="$(mktemp -t "maxy-${kind}-route-dns.XXXXXX")"
-  if tee_subprocess_capture "setup-tunnel:cloudflared" -- \
-      cloudflared --origincert "${CFG_DIR}/cert.pem" \
-      tunnel route dns --overwrite-dns "${TUNNEL_ID}" "${hostname}" \
-      > "${ROUTE_LOG}"; then
-    phase_line setup-tunnel step="${kind}-route-dns" hostname="${hostname}" result=ok
-    rm -f "${ROUTE_LOG}"
-    return 0
-  fi
-  local ROUTE_RC=$?
-  local STDERR_BOUNDED
-  STDERR_BOUNDED="$(tr '\n' ' ' < "${ROUTE_LOG}" | head -c 400)"
-  phase_line setup-tunnel step="${kind}-ingress-deferred" hostname="${hostname}" \
-    reason=route-dns-failed exit="${ROUTE_RC}" stderr="${STDERR_BOUNDED}"
-  echo "WARNING: cloudflared tunnel route dns failed for ${hostname} (exit=${ROUTE_RC})." >&2
-  echo "         HTTPS ingress remains durable; the ${kind} ingress is deferred." >&2
-  rm -f "${ROUTE_LOG}"
-  # Clear the hostname so the config.yml render below skips this entry.
-  if [ "${kind}" = "ssh" ]; then SSH_HOSTNAME=""; else SMB_HOSTNAME=""; fi
-  return 0
-}
-
-route_extra_hostname ssh "${SSH_HOSTNAME}"
-route_extra_hostname smb "${SMB_HOSTNAME}"
-
-# --------------------------------------------------------------------------
-# Step 5: Write config.yml via the unit-tested Node renderer. Every HTTPS
-# hostname (apex + subdomain) gets an ingress rule — apex still needs the
-# rule for the connector to serve traffic once DNS is manually pointed.
-# SSH and SMB rules are inserted between the HTTPS rules and the catch-all
-# http_status:404 (renderer enforces ordering).
-# --------------------------------------------------------------------------
-
-INGRESS_SPEC_FILE="$(mktemp -t maxy-ingress-spec.XXXXXX.json)"
-{
-  printf '{'
-  printf '"tunnelId":"%s",' "${TUNNEL_ID}"
-  printf '"credentialsPath":"%s",' "${CFG_DIR}/${TUNNEL_ID}.json"
-  printf '"httpPort":%s,' "${PORT}"
-  printf '"httpHostnames":['
-  FIRST=1
-  for H in "${HOSTNAMES[@]}"; do
-    if [ ${FIRST} -eq 1 ]; then FIRST=0; else printf ','; fi
-    printf '"%s"' "${H}"
-  done
-  printf '],'
-  printf '"sshHostname":"%s",' "${SSH_HOSTNAME}"
-  printf '"smbHostname":"%s"' "${SMB_HOSTNAME}"
-  printf '}'
-} > "${INGRESS_SPEC_FILE}"
-
-if [ "${SETUP_TUNNEL_DRY_RUN}" = "1" ]; then
-  echo "--- DRY RUN: rendered config.yml ---"
-  node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" render-config "${INGRESS_SPEC_FILE}"
-  echo "--- DRY RUN: end ---"
-  phase_line setup-tunnel step=config-yml-write result=dry-run-skip
-else
-  if ! node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" render-config "${INGRESS_SPEC_FILE}" > "${CFG_DIR}/config.yml"; then
-    phase_line setup-tunnel step=config-yml-write result=error reason=renderer-failed
-    echo "ERROR: tunnel-ingress render-config failed" >&2
-    rm -f "${INGRESS_SPEC_FILE}"
-    exit 1
-  fi
-  echo "wrote ${CFG_DIR}/config.yml"
-fi
-rm -f "${INGRESS_SPEC_FILE}"
-
-if [ -n "${SSH_HOSTNAME}" ]; then
-  phase_line setup-tunnel step=ssh-ingress-added hostname="${SSH_HOSTNAME}" service=ssh://localhost:22
-  echo "[tunnel-install] ssh-ingress-added hostname=${SSH_HOSTNAME} service=ssh://localhost:22"
-fi
-if [ -n "${SMB_HOSTNAME}" ]; then
-  phase_line setup-tunnel step=smb-ingress-added hostname="${SMB_HOSTNAME}" service=tcp://localhost:445
-  echo "[tunnel-install] smb-ingress-added hostname=${SMB_HOSTNAME} service=tcp://localhost:445"
-fi
-
-# --------------------------------------------------------------------------
-# Step 5b: Write tunnel.state via the same renderer. Additive sshHostname /
-# smbHostname fields let the next re-run rehydrate them. Required by
-# resume-tunnel.sh — without it the brand.service's ExecStartPre exits
-# silently without spawning a connector.
-# --------------------------------------------------------------------------
-
-STATE_SPEC_FILE="$(mktemp -t maxy-tunnel-state.XXXXXX.json)"
-{
-  printf '{'
-  printf '"tunnelId":"%s",' "${TUNNEL_ID}"
-  printf '"tunnelName":"%s",' "${TUNNEL_NAME}"
-  printf '"domain":"%s",' "${HOSTNAMES[0]}"
-  printf '"configPath":"%s",' "${CFG_DIR}/config.yml"
-  printf '"credentialsPath":"%s",' "${CFG_DIR}/${TUNNEL_ID}.json"
-  printf '"sshHostname":"%s",' "${SSH_HOSTNAME}"
-  printf '"smbHostname":"%s"' "${SMB_HOSTNAME}"
-  printf '}'
-} > "${STATE_SPEC_FILE}"
-
-if [ "${SETUP_TUNNEL_DRY_RUN}" = "1" ]; then
-  echo "--- DRY RUN: rendered tunnel.state ---"
-  node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" render-state "${STATE_SPEC_FILE}"
-  echo "--- DRY RUN: end ---"
-  phase_line setup-tunnel step=tunnel-state-write result=dry-run-skip
-else
-  if ! node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" render-state "${STATE_SPEC_FILE}" > "${CFG_DIR}/tunnel.state"; then
-    phase_line setup-tunnel step=tunnel-state-write result=error reason=renderer-failed
-    echo "ERROR: tunnel-ingress render-state failed" >&2
-    rm -f "${STATE_SPEC_FILE}"
-    exit 1
-  fi
-  echo "wrote ${CFG_DIR}/tunnel.state"
-fi
-rm -f "${STATE_SPEC_FILE}"
-
-# --------------------------------------------------------------------------
-# Access policy ACTION REQUIRED.
-#
-# The Cloudflare Access policy that gates these new SSH/SMB hostnames must
-# be authored in the dashboard by the operator: CF API/SDK is banned
-# (feedback_cf_api_total_eradication) and `cloudflared` CLI has no
-# Access-application create subcommand. Print the click-path with the
-# resolved hostnames + operator email substituted in. operatorEmail comes
-# from OPERATOR_EMAIL env, falling back to brand.json `.operatorEmail`.
-# --------------------------------------------------------------------------
-
-if [ -n "${SSH_HOSTNAME}${SMB_HOSTNAME}" ]; then
-  RESOLVED_EMAIL="${OPERATOR_EMAIL}"
-  if [ -z "${RESOLVED_EMAIL}" ] && [ -n "${SETUP_TUNNEL_BRAND_JSON}" ] && command -v jq >/dev/null 2>&1; then
-    RESOLVED_EMAIL="$(jq -r '.operatorEmail // empty' "${SETUP_TUNNEL_BRAND_JSON}" 2>/dev/null || true)"
-  fi
-  if [ -z "${RESOLVED_EMAIL}" ]; then
-    RESOLVED_EMAIL="<operator email — set OPERATOR_EMAIL or brand.json .operatorEmail>"
-    phase_line setup-tunnel step=operator-email-unresolved reason=env-and-brand-json-missing
-  fi
-
-  if [ -n "${SSH_HOSTNAME}" ]; then
-    phase_line setup-tunnel step=ssh-access-policy-required hostname="${SSH_HOSTNAME}" allow_emails="${RESOLVED_EMAIL}"
-    echo "[tunnel-install] ssh-access-policy-required hostname=${SSH_HOSTNAME} allow-emails=${RESOLVED_EMAIL}"
-  fi
-  if [ -n "${SMB_HOSTNAME}" ]; then
-    phase_line setup-tunnel step=smb-access-policy-required hostname="${SMB_HOSTNAME}" allow_emails="${RESOLVED_EMAIL}"
-    echo "[tunnel-install] smb-access-policy-required hostname=${SMB_HOSTNAME} allow-emails=${RESOLVED_EMAIL}"
-  fi
-
-  AR_INPUT_FILE="$(mktemp -t maxy-access-req.XXXXXX.json)"
-  {
-    printf '{'
-    printf '"sshHostname":"%s",' "${SSH_HOSTNAME}"
-    printf '"smbHostname":"%s",' "${SMB_HOSTNAME}"
-    printf '"operatorEmail":"%s"' "${RESOLVED_EMAIL}"
-    printf '}'
-  } > "${AR_INPUT_FILE}"
-  node --experimental-strip-types --no-warnings "${TUNNEL_INGRESS_TS}" action-req "${AR_INPUT_FILE}" || true
-  rm -f "${AR_INPUT_FILE}"
-fi
-
-# --------------------------------------------------------------------------
-# Dry-run short-circuit: exit before onboarding / service restart.
-# --------------------------------------------------------------------------
-if [ "${SETUP_TUNNEL_DRY_RUN}" = "1" ]; then
-  phase_line setup-tunnel step=done dry_run=1
-  echo ""
-  echo "DRY RUN complete. No cloudflared mutations made; no service restart."
-  exit 0
-fi
-
-# --------------------------------------------------------------------------
-# Restart the brand's user-space service so resume-tunnel.sh (its
-# ExecStartPre) picks up the new tunnel.state + config.yml and spawns the
-# connector.
-#
-# CRITICAL: this script runs inside ${BRAND}.service's cgroup whenever the
-# admin agent invokes it via the Bash tool. `systemctl --user restart
-# ${BRAND}.service` from inside that cgroup SIGTERMs the whole cgroup —
-# the node server, the claude subprocess, the Bash child, and this script
-# itself. Dispatching the restart to a transient systemd-run
-# unit is the ONLY primitive that creates a new cgroup outside the service
-# — setsid/nohup/disown/& all inherit cgroup membership, and
-# `systemd-run --scope` runs in the caller's scope.
-#
-# The transient timer fires $RESTART_DELAY seconds after dispatch; the
-# script exits 0 cleanly in microseconds, then the timer restarts the
-# service from its own cgroup — semantically identical to an operator
-# SSH-invoked `systemctl restart`. Post-restart verification (connector
-# up + hostname probe) is out of scope here — the client reconnects and
-# the next admin turn can verify via MCP tools.
-# --------------------------------------------------------------------------
-
-if ! systemctl --user list-unit-files "${BRAND}.service" --no-pager --no-legend | grep -q "${BRAND}.service"; then
-  echo "ERROR: user-space service ${BRAND}.service not installed — cannot bring the tunnel up" >&2
-  echo "       Install the platform first (create-maxy) before running this script." >&2
-  exit 1
-fi
-
-if ! command -v systemd-run >/dev/null 2>&1; then
-  phase_line setup-tunnel step=service-restart-dispatched result=error \
-    reason=systemd-run-missing
-  echo "ERROR: systemd-run is not in PATH." >&2
-  echo "       The script dispatches the ${BRAND}.service restart to a transient" >&2
-  echo "       systemd user unit so it does not kill its own cgroup." >&2
-  echo "       Install systemd userspace (standard on supported Maxy Pi images)." >&2
-  exit 1
-fi
-
-RESTART_DELAY=3
-TRANSIENT_UNIT="maxy-tunnel-restart-$$-$(date +%s)"
-phase_line setup-tunnel step=service-restart-dispatched \
-  unit="${TRANSIENT_UNIT}" delay="${RESTART_DELAY}s" \
-  cmd="systemctl --user restart ${BRAND}.service"
-
-# Dispatch via systemd-run --user --on-active — creates a transient unit
-# with its own cgroup that fires the restart after RESTART_DELAY seconds.
-# --collect auto-GCs the unit after it terminates. The script exits before
-# the timer fires; no race because the exit is microseconds and the timer
-# is seconds. Capture stderr so the operator sees the actual systemd-run
-# failure reason (e.g. "Failed to connect to bus" when linger is disabled).
-SYSTEMD_RUN_ERR="$(mktemp -t maxy-systemd-run-err.XXXXXX)"
-if systemd-run --user --unit="${TRANSIENT_UNIT}.service" \
-    --description="Detached restart of ${BRAND}.service" \
-    --on-active="${RESTART_DELAY}s" \
-    --collect \
-    /bin/systemctl --user restart "${BRAND}.service" 2>"${SYSTEMD_RUN_ERR}"; then
-  RESTART_RC=0
-else
-  RESTART_RC=$?
-fi
-
-if [ "${RESTART_RC}" -ne 0 ]; then
-  STDERR_TEXT="$(cat "${SYSTEMD_RUN_ERR}" 2>/dev/null | tr '\n' ' ' | head -c 500 || echo 'unavailable')"
-  rm -f "${SYSTEMD_RUN_ERR}"
-  phase_line setup-tunnel step=service-restart-dispatched result=error \
-    reason=systemd-run-failed exit="${RESTART_RC}" unit="${TRANSIENT_UNIT}" \
-    stderr="${STDERR_TEXT}"
-  echo "ERROR: systemd-run failed to dispatch the transient restart (exit=${RESTART_RC})." >&2
-  echo "       systemd-run stderr: ${STDERR_TEXT}" >&2
-  echo "       If stderr mentions 'Failed to connect to bus', the user-scope systemd" >&2
-  echo "       instance isn't running. Fix: 'loginctl enable-linger \$(whoami)' and retry." >&2
-  echo "       The service was NOT restarted. Re-run the script or restart manually:" >&2
-  echo "         systemctl --user restart ${BRAND}.service" >&2
-  exit 1
-fi
-rm -f "${SYSTEMD_RUN_ERR}"
-
-phase_line setup-tunnel step=service-restart-armed exit=0 unit="${TRANSIENT_UNIT}"
-echo "${BRAND}.service restart armed via ${TRANSIENT_UNIT} (fires in ${RESTART_DELAY}s)."
-
-# --------------------------------------------------------------------------
-# Apex ACTION REQUIRED summary
-# --------------------------------------------------------------------------
-
-if [ "${#APEX_HOSTNAMES[@]}" -gt 0 ]; then
-  echo ""
-  echo "============================================================"
-  echo "ACTION REQUIRED — manual dashboard step(s) for apex hostnames"
-  echo "============================================================"
-  for H in "${APEX_HOSTNAMES[@]}"; do
-    echo "  ${H}"
-    echo "    Cloudflare dashboard → ${H} zone → DNS → Records"
-    echo "    Edit (or Add) CNAME record:"
-    echo "      Name:    @  (zone apex)"
-    echo "      Content: ${TUNNEL_ID}.cfargotunnel.com"
-    echo "      Proxy:   Proxied (orange cloud)"
-    echo ""
-  done
-  echo "Until each apex record is set, those hostnames will return 1033."
-  echo "============================================================"
-fi
-
-phase_line setup-tunnel step=done tunnel="${TUNNEL_NAME}" id="${TUNNEL_ID}"
-echo ""
-echo "Done. tunnel=${TUNNEL_NAME} id=${TUNNEL_ID}"
-echo "Service will restart in ~${RESTART_DELAY}s to load the new config."
-echo "Verify hostnames with: curl -I https://${HOSTNAMES[0]}"