@rubytech/create-maxy 1.0.623 → 1.0.624

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -2,883 +2,21 @@ import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
 initStderrTee("cloudflare");
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-import { Resolver } from "node:dns/promises";
-import { hostname as osHostname } from "node:os";
-import * as cloudflared from "./lib/cloudflared.js";
-import * as orchestrator from "./lib/setup-orchestrator.js";
-import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
-/** Sign-in is a device-bound flow — Cloudflare's OAuth callback lands on
- *  cloudflared's local HTTP server on the device, so the operator must
- *  complete the sign-in from the device's browser. Emit the auth URL as
- *  a maxy-device-url fenced block so the chat UI renders a click-to-open
- *  button rather than a plain link. See Task 546 and .docs/web-chat.md. */
-function cloudflareSignInBlock(authUrl) {
-    return deviceUrlBlock({
-        url: authUrl,
-        intent: "Sign in to Cloudflare",
-        hostname: osHostname(),
-    });
-}
+// Task 554: the Cloudflare plugin exposes zero agent-facing tools. Every
+// Cloudflare operation is driven by shell scripts (setup-tunnel.sh,
+// reset-tunnel.sh) invoked via Bash, plus dashboard click-paths relayed
+// verbatim from the skill's reference files. The MCP server process
+// still spawns for lifecycle and stderr-tee consistency with other
+// plugins, but its tool list is empty by design.
+//
+// See platform/plugins/cloudflare/skills/setup-tunnel/SKILL.md and
+// platform/plugins/cloudflare/references/ for the operator-facing
+// surface. `lib/cloudflared.ts` and `lib/setup-orchestrator.ts` are
+// retained as private implementation layers that nothing currently
+// imports; a follow-up task will delete them once that is confirmed.
 const server = new McpServer({
     name: "cloudflare",
-    version: "0.3.0",
-});
-// ---------------------------------------------------------------------------
-// tunnel-status trailing guidance — deterministic 1:1 mapping from status
-// enum → single prescribed recovery sentence.
-//
-// The trailing string is a prompt for the agent's next turn. Task 541 closed
-// the recurrence loop where a "check in the browser" sentence primed a 44-
-// tool-call dashboard cascade. The mapping here is exhaustive for every
-// reachable `unhealthyReason`; there is no generic fallback branch. Each
-// sentence names exactly one next action so the agent cannot fork on it.
-// ---------------------------------------------------------------------------
-const BOUND_ACCOUNT_MISMATCH_SENTENCE = (hostname) => `Sign in to Cloudflare at dash.cloudflare.com in the account that owns ${hostname} — ` +
-    `the account with the little orange cloud next to it in your browser tab — then tell me ` +
-    `and I'll restart the tunnel login.`;
-function buildTunnelStatusGuidance(status) {
-    if (!status.unhealthyReason)
-        return "";
-    if (status.unhealthyReason === "not-running") {
-        return `\n\nThe tunnel process is not running. Ask the user if they want me to enable it.`;
-    }
-    if (status.unhealthyReason === "no-tunnel-configured") {
-        return `\n\nNo tunnel is configured on this laptop yet. Run tunnel-create to set one up.`;
-    }
-    if (status.unhealthyReason === "bound-account-does-not-own-hostname") {
-        // Use the first configured hostname as the anchor — matches how the
-        // operator thinks about the setup. If configuredHostnames is empty
-        // (unreachable here because the enum is only set when probes ran)
-        // fall back to domain.
-        const anchor = status.configuredHostnames[0] ??
-            status.persistedHostnames[0] ??
-            status.domain ??
-            "your domain";
-        return `\n\n${BOUND_ACCOUNT_MISMATCH_SENTENCE(anchor)}`;
-    }
-    if (status.unhealthyReason === "hostname-probes-failed") {
-        // Dominant per-hostname mode drives the sentence. All failing probes
-        // share one mode in the expected failure classes — when they diverge,
-        // the first failure wins (the per-hostname list is already printed in
-        // the JSON above; the sentence names the one action the agent takes).
-        const firstFailure = status.probes.find((p) => p.failureMode !== "ok");
-        const mode = firstFailure?.failureMode ?? "edge-unreachable";
-        if (mode === "tunnel-not-matched" || mode === "cname-points-elsewhere") {
-            return `\n\nDNS is pointing at a different tunnel. I'll re-point it.`;
-        }
-        if (mode === "dns-missing") {
-            return `\n\nDNS is not set up yet. I'll create it.`;
-        }
-        // edge-unreachable — transient Cloudflare edge or connectivity; the
-        // agent should not immediately re-probe or open the dashboard.
-        return `\n\nThe tunnel is not reachable through Cloudflare right now. This usually clears in a minute.`;
-    }
-    // Exhaustiveness guard — a new enum value must be added to this switch
-    // before it ever appears in a tool result. Returning empty string would
-    // let a novel failure mode silently emit JSON-only output. The bare
-    // assignment (no `as never` cast) is the point: TypeScript narrows
-    // `status.unhealthyReason` to `never` after every branch above returns,
-    // so a new `TunnelUnhealthyReason` value introduced without a branch
-    // here fails at compile time.
-    const _exhaustive = status.unhealthyReason;
-    console.error(`[cloudflare:tunnel-status:unknown-reason] reason=${String(_exhaustive)}`);
-    return "";
-}
-// ===================================================================
-// Authentication — OAuth cert.pem only
-//
-// The plugin recognises exactly one identity: the Cloudflare account
-// cert.pem was bound to via `cloudflared tunnel login`. No API token
-// handling, no SDK, no read of account state by any code path. The
-// operator's logged-in Cloudflare dashboard session is the source of
-// truth for which domains exist and who owns them; the agent's role
-// is to instruct the operator where to click.
-// ===================================================================
-server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunnel login`. Three phases: (1) if cert.pem exists and matches the recorded account binding, reports status; (2) if cert.pem exists but no binding has been recorded, materializes the binding from the cert (migration path); (3) if no cert.pem, spawns login process and returns the auth URL. Detects existing login processes — safe to call repeatedly without spawning duplicates. Pass force=true to delete cert.pem (both brand-specific and legacy paths) and account-binding.json before re-authenticating — required when switching Cloudflare accounts.", {
-    force: z
-        .boolean()
-        .optional()
-        .describe("Delete cert.pem (brand path + legacy ~/.cloudflared/cert.pem) and account-binding.json before re-authenticating. Required when switching Cloudflare accounts (e.g. after the prior account was scrubbed or the cert was rotated under a different account)."),
-}, async ({ force }) => {
-    try {
-        if (force) {
-            console.error("[tunnel-login] force=true — clearing cert.pem and account binding before re-auth");
-            cloudflared.resetAuth();
-        }
-        const auth = cloudflared.validateAuth();
-        if (auth.bound) {
-            console.error(`[cloudflare:tunnel-login:complete] accountId=${auth.boundAccountId}`);
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Sign-in complete.`,
-                    },
-                ],
-            };
-        }
-        if (auth.hasCert) {
-            const creds = cloudflared.parseCertPem();
-            if (!creds) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Sign-in file exists but its contents are unreadable. Ask me to run tunnel-login with force=true so the file is cleared and a fresh sign-in can start.`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-            if (!auth.hasBinding) {
-                cloudflared.materializeBinding("migration");
-                console.error(`[cloudflare:tunnel-login:complete] accountId=${auth.certAccountId} source=migration`);
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Sign-in complete.`,
-                        },
-                    ],
-                };
-            }
-            if (auth.certAccountId !== auth.boundAccountId) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `The Cloudflare sign-in on this laptop has changed since it was first set up. ${cloudflared.recoveryMessage()}`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-        }
-        if (!cloudflared.isInstalled()) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "cloudflared is not installed. Run tunnel-install first.",
-                    },
-                ],
-                isError: true,
-            };
-        }
-        // Three-state login machine. `complete` is already handled above via
-        // `auth.bound` / migration path, so here we branch on in-progress vs.
-        // terminal failure (PID dead + cert absent, regardless of why). Both
-        // branches emit a `maxy-device-url` fenced block so the chat UI
-        // renders a click-to-open-on-device button — cloudflared's courtesy
-        // browser-launch failing no longer matters to the operator because
-        // the button drives the device's VNC browser directly.
-        const loginStatus = cloudflared.getLoginStatus();
-        if (loginStatus.state === "failed") {
-            console.error(`[cloudflare:tunnel-login:failed] reason=${loginStatus.reason} ` +
-                `pid=${loginStatus.loginState?.pid ?? "none"}`);
-            cloudflared.resetAuth();
-            const restarted = await cloudflared.tunnelLogin();
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Sign-in ended without saving the cert. Restarting.\n\n` +
-                            `${cloudflareSignInBlock(restarted.authUrl)}\n\n` +
-                            `Click the button to open the Cloudflare sign-in page on the device's browser. ` +
-                            `Pick the Cloudflare account you want this laptop signed into, then click Authorize. ` +
-                            `Call tunnel-login again once you confirm — it will detect the completed sign-in automatically.`,
-                    },
-                ],
-            };
-        }
-        if (loginStatus.state === "in-progress") {
-            console.error(`[cloudflare:tunnel-login:waiting] pid=${loginStatus.loginState.pid} authUrl=${loginStatus.loginState.authUrl}`);
-            if (loginStatus.browserLaunchFailed) {
-                // Task 545 observability: cloudflared's browser-launch subcommand
-                // failed but the OAuth callback loop is still alive. Task 546
-                // resolves the user-facing half of this — the device-URL block
-                // below renders as a click-to-open-on-device button in the chat
-                // UI, so the operator does not need to know cloudflared's
-                // launcher misbehaved. The log line remains for diagnostics.
-                console.error(`[cloudflare:tunnel-login:browser-launch-failed] pid=${loginStatus.loginState.pid}`);
-            }
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Sign-in in progress — a browser window is already open on the device (started ${new Date(loginStatus.loginState.startedAt).toISOString()}).\n\n` +
-                            `${cloudflareSignInBlock(loginStatus.loginState.authUrl)}\n\n` +
-                            `Finish the sign-in on the device's browser and click Authorize. ` +
-                            `Call tunnel-login again once you confirm — it will detect the completed sign-in automatically.`,
-                    },
-                ],
-            };
-        }
-        // state === "idle" — spawn fresh.
-        const result = await cloudflared.tunnelLogin();
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Cloudflare sign-in started on the device.\n\n` +
-                        `${cloudflareSignInBlock(result.authUrl)}\n\n` +
-                        `Click the button to open the sign-in page on the device's browser. ` +
-                        `Pick the Cloudflare account you want this laptop signed into, then click Authorize. ` +
-                        `Call tunnel-login again once you confirm — it will detect the completed sign-in automatically.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Sign-in failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-status", "End-to-end Cloudflare Tunnel status. Reads the tunnel process state, parses configured hostnames from config.yml, and probes each hostname (DNS + HTTPS via Cloudflare's edge) to confirm traffic actually reaches this laptop from the internet. `healthy: true` requires every configured hostname to probe `ok`. `boundAccountOwnsHostnames: false` means the laptop is running a tunnel that nothing on the internet can reach — almost always because it is signed into a Cloudflare account that does not own the domain.", {
-    domain: z
-        .string()
-        .optional()
-        .describe("The bare domain (e.g. 'maxy.bot'). If omitted, derived from persisted state."),
-}, async ({ domain }) => {
-    try {
-        const status = await cloudflared.getStatus(domain);
-        const guidance = buildTunnelStatusGuidance(status);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(status, null, 2) + guidance,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-install", "Install the cloudflared binary if not already present.", {}, async () => {
-    const { execFileSync } = await import("node:child_process");
-    if (cloudflared.isInstalled()) {
-        const v = cloudflared.version();
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `cloudflared is already installed (v${v}).`,
-                },
-            ],
-        };
-    }
-    try {
-        const arch = process.arch === "arm64" ? "arm64" : "amd64";
-        const debUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${arch}.deb`;
-        execFileSync("curl", ["-fsSL", debUrl, "-o", "/tmp/cloudflared.deb"], {
-            timeout: 60000,
-        });
-        execFileSync("sudo", ["dpkg", "-i", "/tmp/cloudflared.deb"], {
-            timeout: 30000,
-        });
-        execFileSync("rm", ["-f", "/tmp/cloudflared.deb"]);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `cloudflared installed (v${cloudflared.version()}).`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Installation failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the specified subdomains. The admin subdomain is required (e.g. 'admin' → admin.{domain}, 'joel' → joel.{domain}). The public subdomain is optional — omit to skip the public endpoint. Shells out to `cloudflared` which uses the signed-in cert.pem; refuses when the configured domain is not on the signed-in Cloudflare account. Idempotent — reuses existing tunnel if name matches.", {
-    domain: z
-        .string()
-        .describe("The bare domain (e.g. 'maxy.bot')."),
-    adminSubdomain: z
-        .string()
-        .min(1)
-        .describe("Subdomain for the admin interface (e.g. 'admin', 'joel'). Creates {adminSubdomain}.{domain}."),
-    publicSubdomain: z
-        .string()
-        .min(1)
-        .optional()
-        .describe("Subdomain for the public chat (e.g. 'public', 'shop'). Creates {publicSubdomain}.{domain}. Omit to skip the public endpoint."),
-    tunnelName: z
-        .string()
-        .optional()
-        .describe("Human-readable tunnel name (default: derived from domain)"),
-}, async ({ domain, adminSubdomain, publicSubdomain, tunnelName }) => {
-    if (publicSubdomain && adminSubdomain === publicSubdomain) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Invalid: adminSubdomain and publicSubdomain are both "${adminSubdomain}". They must be different.`,
-                },
-            ],
-            isError: true,
-        };
-    }
-    try {
-        const auth = cloudflared.validateAuth();
-        if (!auth.bound) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `REFUSED: this laptop is not signed into Cloudflare yet. ${cloudflared.recoveryMessage()}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const name = tunnelName ?? domain.replace(/\./g, "-");
-        const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
-        const adminHostname = `${adminSubdomain}.${domain}`;
-        const publicHostname = publicSubdomain ? `${publicSubdomain}.${domain}` : null;
-        const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
-        console.error(`[tunnel-create] hostnames=${JSON.stringify(hostnames)} domain=${domain}`);
-        // Step 1: Create tunnel via CLI (idempotent — reuses if name exists)
-        const tunnel = cloudflared.createTunnelCli(name);
-        // Step 2: Write local config.yml with ingress rules
-        const configPath = cloudflared.writeLocalConfig(tunnel.tunnelId, tunnel.credentialsPath, hostnames, platformPort);
-        // Persist tunnel identity with actual hostnames
-        cloudflared.saveTunnelIdentity({
-            tunnelId: tunnel.tunnelId,
-            tunnelName: tunnel.tunnelName,
-            domain,
-            configPath,
-            credentialsPath: tunnel.credentialsPath,
-            adminHostname,
-            publicHostname,
-        });
-        // Step 3: Route DNS via CLI for each hostname (pre-flight + post-flight in routeDnsCli)
-        const dnsResults = [];
-        for (const h of hostnames) {
-            const route = await cloudflared.routeDnsCli(tunnel.tunnelId, h);
-            dnsResults.push({
-                hostname: h,
-                fqdn: route.fqdn,
-                note: route.created ? "created" : "already existed",
-            });
-        }
-        // Step 4: Verify hostnames resolve via public DNS
-        const resolver = new Resolver();
-        resolver.setServers(["1.1.1.1", "8.8.8.8"]);
-        const dnsWarnings = [];
-        for (const h of hostnames) {
-            try {
-                await resolver.resolve4(h);
-            }
-            catch {
-                dnsWarnings.push(h);
-            }
-        }
-        let dnsNote = "";
-        if (dnsWarnings.length > 0) {
-            dnsNote = `\n\nDNS WARNING: ${dnsWarnings.join(", ")} did not resolve via public DNS yet. DNS propagation typically takes 1-5 minutes. Re-run tunnel-status in a few minutes to confirm.`;
-        }
-        const dnsLines = dnsResults
-            .map((r) => `  ${r.hostname} → this tunnel (${r.note})`)
-            .join("\n");
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Tunnel created.\n\n  Name: ${tunnel.tunnelName}\n${dnsLines}\n  Config: ${configPath}\n\nUse tunnel-enable to start the tunnel.${dnsNote}`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        if (err instanceof cloudflared.CloudflareRefusalError) {
-            return {
-                content: [{ type: "text", text: err.refusal.message }],
-                isError: true,
-            };
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Create failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel must be created first via tunnel-create. Reads hostnames from persisted state for DNS verification and reachability checks. If tunnelId and domain are omitted, reads them from persisted tunnel state.", {
-    tunnelId: z.string().optional().describe("Tunnel UUID from tunnel-create. If omitted, reads from persisted tunnel state."),
-    domain: z.string().optional().describe("The bare domain (e.g. 'maxy.bot'). If omitted, reads from persisted tunnel state."),
-}, async ({ tunnelId: tunnelIdParam, domain: domainParam }) => {
-    try {
-        const tunnelId = tunnelIdParam ?? cloudflared.getPersistedTunnelId();
-        const domain = domainParam ?? cloudflared.getPersistedDomain();
-        if (!tunnelId) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "No tunnel found on this laptop. Run tunnel-create first.",
-                    },
-                ],
-                isError: true,
-            };
-        }
-        if (!domain) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "No domain recorded for this tunnel. Run tunnel-create first to set one up with a domain.",
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const hostnames = cloudflared.getPersistedHostnames();
-        if (hostnames.length === 0) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: "No addresses recorded for this tunnel. Run tunnel-create first.",
-                    },
-                ],
-                isError: true,
-            };
-        }
-        console.error(`[tunnel-enable] checking hostnames=${JSON.stringify(hostnames)}`);
-        // GATE 1: Check if actual hostnames resolve via public DNS
-        const resolver = new Resolver();
-        resolver.setServers(["1.1.1.1", "8.8.8.8"]);
-        const unresolvedSubs = [];
-        for (const h of hostnames) {
-            try {
-                await resolver.resolve4(h);
-            }
-            catch {
-                unresolvedSubs.push(h);
-            }
-        }
-        if (unresolvedSubs.length > 0) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `REFUSED: ${unresolvedSubs.join(", ")} do not resolve via public DNS. The tunnel's URLs will not work.\n\nUsually this means the DNS records were never created or are still propagating. Run tunnel-create first. If that has already run, wait 1-5 minutes for propagation or ask the user to confirm in the Cloudflare dashboard that the addresses exist on the correct domain.\n\nDo not call tunnel-enable until the addresses resolve.`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const brand = cloudflared.loadBrand();
-        const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
-        console.error(`[tunnel-enable] using PLATFORM_PORT=${platformPort}`);
-        // GATE 2: Remote auth must be configured
-        try {
-            const res = await fetch(`http://127.0.0.1:${platformPort}/api/remote-auth/status`, {
-                signal: AbortSignal.timeout(5000),
-            });
-            const body = await res.json();
-            if (!body.configured) {
-                const setupUrl = `http://${osHostname()}.local:${platformPort}/__remote-auth/setup`;
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `REFUSED: Remote access password is not configured. The admin interface would be exposed to the internet without authentication.\n\n` +
-                                `${deviceUrlBlock({ url: setupUrl, intent: "Set remote access password", hostname: osHostname() })}\n\n` +
-                                `Click the button to open the setup page on the device's browser, set the password, then ask me to enable the tunnel again. Do NOT collect the password in chat.`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-        }
-        catch {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `REFUSED: Cannot verify remote authentication — the web server at http://127.0.0.1:${platformPort} is not reachable. The admin interface cannot be exposed without a running auth gate.\n\nEnsure the ${brand.productName} platform is running before enabling the tunnel.`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        // GATE 3: cert.pem + binding
-        const enableAuth = cloudflared.validateAuth();
-        if (!enableAuth.bound) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `REFUSED: Cannot start tunnel — this laptop is not signed into Cloudflare or the sign-in has drifted. ${cloudflared.recoveryMessage()}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        // GATE 4: config.yml must exist
-        const tunnelState = cloudflared.getPersistedState();
-        const configPath = tunnelState?.configPath;
-        const credentialsPath = tunnelState?.credentialsPath;
-        const tunnelName = tunnelState?.tunnelName ?? tunnelId;
-        if (!configPath) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `REFUSED: No tunnel configuration found. Run tunnel-create first — it writes the config.yml needed to start the tunnel.`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        cloudflared.startTunnel({
-            tunnelId,
-            tunnelName,
-            domain,
-            configPath,
-            credentialsPath: credentialsPath ?? "",
-        });
-        const logHint = `~/${brand.configDir}/logs/cloudflared.log`;
-        for (let i = 0; i < 10; i++) {
-            await new Promise((r) => setTimeout(r, 500));
-            const status = await cloudflared.getStatus(domain);
-            if (!status.running) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Tunnel process exited immediately after starting. Check ${logHint} for details.`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-        }
-        const status = await cloudflared.getStatus(domain);
-        const verifyUrl = `https://${hostnames[0]}`;
-        let verified = false;
-        console.error(`[tunnel-enable] verifying url=${verifyUrl}`);
-        for (let attempt = 0; attempt < 6; attempt++) {
-            if (attempt > 0)
-                await new Promise((r) => setTimeout(r, 5000));
-            try {
-                const res = await fetch(verifyUrl, {
-                    signal: AbortSignal.timeout(10000),
-                    redirect: "manual",
-                });
-                console.error(`[tunnel-enable] verified url=${verifyUrl} status=${res.status}`);
-                if (res.status !== 530) {
-                    verified = true;
-                    break;
-                }
-            }
-            catch {
-                // network error — retry
-            }
-        }
-        if (!verified) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Tunnel process is running (PID ${status.pid}) but ${verifyUrl} returned 530 after 30s of retries. Cloudflare's edge cannot reach this tunnel.\n\nCommon causes:\n  1. Stale DNS records pointing to a previous tunnel — run tunnel-create again to fix\n  2. UDP buffer too small for QUIC — check ${logHint}\n  3. Firewall blocking outbound QUIC to Cloudflare's edge\n\nThe tunnel is NOT working. Do not report success.`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const urlLines = hostnames.map((h, i) => {
-            const label = i === 0 ? "Admin" : "Public";
-            return `  ${label}: https://${h}`;
-        }).join("\n");
-        const reachableNote = hostnames.length > 1
-            ? "All URLs are reachable through Cloudflare."
-            : "The admin URL is reachable through Cloudflare.";
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Tunnel started and verified.\n\n  PID: ${status.pid}\n${urlLines}\n\n${reachableNote} The tunnel auto-starts on device reboot.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        if (err instanceof cloudflared.CloudflareRefusalError) {
-            return {
-                content: [{ type: "text", text: err.refusal.message }],
-                isError: true,
-            };
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Enable failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-disable", "Stop the Cloudflare Tunnel process. Config is preserved for re-enabling.", {}, async () => {
-    try {
-        cloudflared.stopTunnel();
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "Tunnel stopped. Config preserved — use tunnel-enable to restart.",
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Disable failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-add-hostname", "Add an additional address to an existing Cloudflare Tunnel. Refuses pre-flight when the hostname's domain is not on Cloudflare, and refuses post-flight when `cloudflared` routes the address under a different domain (meaning the laptop is signed into the wrong Cloudflare account). Idempotent — safe to call again with the same hostname.", {
-    hostname: z
-        .string()
-        .describe("The address to add (e.g. 'maxy.chat'). The domain must be on the Cloudflare account this laptop is signed into."),
-    tunnelId: z
-        .string()
-        .describe("The tunnel UUID. Get this from tunnel-status."),
-}, async ({ hostname, tunnelId }) => {
-    try {
-        const route = await cloudflared.routeDnsCli(tunnelId, hostname);
-        cloudflared.saveAliasDomain(hostname);
-        const routeNote = route.created
-            ? "created"
-            : "already existed";
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Address configured.\n\n  Address: ${hostname}\n  Routing: ${routeNote}\n  Web server: registered in alias-domains.json (hot-reloaded automatically)\n\nhttps://${hostname} will be active once DNS propagates (1-5 minutes). Run tunnel-status to confirm.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        if (err instanceof cloudflared.CloudflareRefusalError) {
-            return {
-                content: [{ type: "text", text: err.refusal.message }],
-                isError: true,
-            };
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Failed to add address: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslookup (not installed on Pi). Supports A, AAAA, CNAME, MX, TXT, NS, and SOA record types.", {
-    hostname: z
-        .string()
-        .describe("The hostname to resolve (e.g. 'admin.maxy.bot')"),
-    type: z
-        .enum(["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SOA"])
-        .optional()
-        .describe("Record type (default: A)"),
-    nameserver: z
-        .string()
-        .optional()
-        .describe("Custom nameserver IP (default: Cloudflare 1.1.1.1 + Google 8.8.8.8)"),
-}, async ({ hostname, type, nameserver }) => {
-    try {
-        const resolver = new Resolver();
-        resolver.setServers(nameserver ? [nameserver] : ["1.1.1.1", "8.8.8.8"]);
-        const recordType = type ?? "A";
-        const results = {
-            hostname,
-            type: recordType,
-        };
-        switch (recordType) {
-            case "A": {
-                results.addresses = await resolver.resolve4(hostname);
-                break;
-            }
-            case "AAAA": {
-                results.addresses = await resolver.resolve6(hostname);
-                break;
-            }
-            case "CNAME": {
-                try {
-                    results.cnames = await resolver.resolveCname(hostname);
-                }
-                catch (cnameErr) {
-                    const cnameCode = cnameErr.code;
-                    if (cnameCode === "ENODATA") {
-                        try {
-                            const aRecords = await resolver.resolve4(hostname);
-                            results.note = "CNAME lookup returned ENODATA — record is likely flattened to A";
-                            results.addresses = aRecords;
-                        }
-                        catch {
-                            throw cnameErr;
-                        }
-                    }
-                    else {
-                        throw cnameErr;
-                    }
-                }
-                break;
-            }
-            case "MX": {
-                results.exchanges = await resolver.resolveMx(hostname);
-                break;
-            }
-            case "TXT": {
-                results.records = await resolver.resolveTxt(hostname);
-                break;
-            }
-            case "NS": {
-                results.nameservers = await resolver.resolveNs(hostname);
-                break;
-            }
-            case "SOA": {
-                results.soa = await resolver.resolveSoa(hostname);
-                break;
-            }
-        }
-        return {
-            content: [
-                { type: "text", text: JSON.stringify(results, null, 2) },
-            ],
-        };
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        const code = err.code;
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `DNS lookup failed: ${msg}${code ? ` (${code})` : ""}\n\nCommon causes:\n- ENOTFOUND: hostname does not exist\n- ENODATA: no records of this type for hostname\n- ETIMEOUT: nameserver unreachable`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-// ===================================================================
-// Setup orchestrator — deterministic multi-step flow (Task 547)
-//
-// `cloudflare-setup-run` is the single operator-facing entry point for
-// tunnel setup. It drives the full login → create → enable → verify
-// sequence in code, using the enum output of `tunnel-status` to decide
-// each transition. The LLM never picks between tunnel-login/create/enable
-// during an active setup — those tools are removed from its menu by the
-// tool-surface filter (platform/ui/app/lib/tool-surface-filter.ts) while
-// `phase !== 'idle' && phase !== 'healthy' && phase !== 'unhealthy'`.
-//
-// See platform/plugins/cloudflare/mcp/src/lib/setup-orchestrator.ts for
-// the state machine.
-// ===================================================================
-server.tool("cloudflare-setup-run", "Run the full Cloudflare tunnel setup to completion. Single operator-facing entry point — handles sign-in, tunnel creation, DNS routing, and verification deterministically. Every sub-step is chosen in code, not by the LLM. Pass `domain` on the first call. Pass `adminSubdomain` (and optional `publicSubdomain`) once sign-in is complete. Pass `confirmed: true` to acknowledge the operator has finished a device-bound step (signed in, switched accounts). Re-entrant — safe to invoke repeatedly; persisted state resumes at the correct phase.", {
-    domain: z
-        .string()
-        .optional()
-        .describe("The bare domain (e.g. 'maxy.bot'). Required on the first call; ignored afterwards."),
-    adminSubdomain: z
-        .string()
-        .optional()
-        .describe("Admin subdomain label (e.g. 'admin' → admin.{domain}). Provide when the tool asks for subdomains."),
-    publicSubdomain: z
-        .string()
-        .optional()
-        .describe("Optional public chat subdomain label. Leave unset to skip the public endpoint."),
-    confirmed: z
-        .boolean()
-        .optional()
-        .describe("Set to true to signal the operator has completed a device-bound action (signed in, switched Cloudflare accounts). Ignored in phases where no such action is pending."),
-}, async ({ domain, adminSubdomain, publicSubdomain, confirmed }) => {
-    try {
-        const result = await orchestrator.runOrchestrator({
-            domain,
-            adminSubdomain,
-            publicSubdomain,
-            confirmed,
-        });
-        return {
-            content: [{ type: "text", text: result.text }],
-            isError: !result.healthy && (result.phase === "unhealthy"),
-        };
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[cloudflare:setup-run:threw] ${msg}`);
-        return {
-            content: [{ type: "text", text: `Tunnel setup encountered an unexpected error: ${msg}` }],
-            isError: true,
-        };
-    }
-});
-server.tool("cloudflare-setup-status", "Report the current tunnel-setup orchestrator phase without advancing it. Use this for diagnostics — to answer 'where is the setup flow right now?' — not as a routine pre-check before `cloudflare-setup-run` (the run tool reads and reconciles state on every call).", {}, async () => {
-    const state = orchestrator.readOrchestratorState();
-    return {
-        content: [
-            {
-                type: "text",
-                text: JSON.stringify({
-                    phase: state.phase,
-                    domain: state.domain,
-                    adminSubdomain: state.adminSubdomain,
-                    publicSubdomain: state.publicSubdomain,
-                    tunnelId: state.tunnelId,
-                    phaseEnteredAt: state.phaseEnteredAt,
-                    unhealthyReason: state.unhealthyReason,
-                    setupActive: orchestrator.isSetupActive(state),
-                }, null, 2),
-            },
-        ],
-    };
+    version: "0.4.0",
 });
 async function main() {
     const transport = new StdioServerTransport();