@rubytech/create-realagent 1.0.612 → 1.0.614

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.612",
+  "version": "1.0.614",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -18,7 +18,7 @@ tools:
 
 # Cloudflare Tunnel Setup
 
-Guides through setting up a Cloudflare Tunnel so customers can reach this assistant via a custom domain (e.g., `chat.mybusiness.com`). All operations are deterministic MCP tool calls — auth via `tunnel-login` (one-click OAuth) or `cf-set-token` (paste token), zone/tunnel/DNS via the official Cloudflare SDK. Browser-specialist is navigation-only (screenshots + page state) — no `browser_evaluate`, no dashboard API scripts.
+Guides through setting up a Cloudflare Tunnel so customers can reach this assistant via a custom domain (e.g., `chat.mybusiness.com`). `cloudflare-setup` is the single orchestrator — a UI-driven state machine that prompts the user for tunnel/zone selections and admin/public addresses via rendered components (`single-select`, `tunnel-route-picker`). Tunnel names are unique per customer (derived from the chosen admin label + domain) so multiple customers can coexist on a shared zone like `maxy.bot`. The agent never synthesises subdomains from free text — every label comes from a component submission. Auth via `tunnel-login` (one-click OAuth) or `cf-set-token` (paste token). Browser-specialist is navigation-only — no dashboard forms.
 
 ## When to activate
 

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -3,7 +3,9 @@ initStderrTee("cloudflare");
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { hostname } from "node:os";
+import { join } from "node:path";
+import { hostname, homedir } from "node:os";
+import { existsSync } from "node:fs";
 import * as cloudflared from "./lib/cloudflared.js";
 const server = new McpServer({
     name: "cloudflare",
@@ -933,23 +935,35 @@ server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslo
         };
     }
 });
-server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare Tunnel setup. Checks current state, advances as far as possible, returns structured result. Call once, relay the message to the user. When the user confirms an action, call again — the tool picks up where it left off. Zero agent judgment required. adminSubdomain defaults to 'admin', publicSubdomain defaults to 'public'. Set publicSubdomain to skip the public endpoint.", {
-    domain: z
+const LABEL_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+function sanitizedDomain(domain) {
+    return domain.replace(/\./g, "-");
+}
+function deriveTunnelName(adminLabel, domain) {
+    return `${adminLabel}-${sanitizedDomain(domain)}`;
+}
+function hasBrandCredsFor(tunnelId) {
+    const path = join(homedir(), cloudflared.loadBrand().configDir, "cloudflared", `${tunnelId}.json`);
+    return existsSync(path);
+}
+server.tool("cloudflare-setup", "Deterministic, UI-driven state machine for Cloudflare Tunnel setup. Call with no parameters to begin; the tool evaluates current state and returns a structured result describing what to render next. When a returned status begins with 'awaiting_', read `data.render` and call render-component with its contents verbatim — do not paraphrase, do not prompt the user for values. When the user submits a component (single-select, tunnel-route-picker), the agent's sole job is to relay the submission's fields (selectedTunnelId, selectedZoneName, adminLabel, publicLabel) back into this tool unchanged. The agent never synthesises subdomains or domain fragments from free text.", {
+    selectedTunnelId: z
         .string()
-        .describe("The bare domain (e.g. 'maxy.bot')."),
-    adminSubdomain: z
+        .optional()
+        .describe("Tunnel ID from the single-select submission. The literal string '__new__' means the user chose to create a new tunnel. Pass only when the last component rendered was the tunnel selection list."),
+    selectedZoneName: z
         .string()
-        .min(1)
         .optional()
-        .describe("Subdomain for admin interface (default: 'admin'). Creates {adminSubdomain}.{domain}."),
-    publicSubdomain: z
+        .describe("Zone name from the single-select submission. Pass only when the last component rendered was the zone selection list."),
+    adminLabel: z
+        .string()
+        .optional()
+        .describe("Admin DNS label from the tunnel-route-picker submission. DNS-label-safe (a-z, 0-9, hyphen, no leading/trailing hyphen). Pass only when the last component rendered was tunnel-route-picker."),
+    publicLabel: z
         .string()
-        .min(1)
         .optional()
-        .describe("Subdomain for public chat (default: 'public'). Creates {publicSubdomain}.{domain}. Omit or set explicitly to skip the public endpoint."),
-}, async ({ domain, adminSubdomain: adminSubParam, publicSubdomain: publicSubParam }) => {
-    const adminSubdomain = adminSubParam ?? "admin";
-    const publicSubdomain = publicSubParam ?? "public";
+        .describe("Public DNS label from the tunnel-route-picker submission. Optional; omit to skip the public endpoint. DNS-label-safe. Pass only when the last component rendered was tunnel-route-picker."),
+}, async ({ selectedTunnelId, selectedZoneName, adminLabel, publicLabel }) => {
     const log = (msg) => console.error(`[cloudflare-setup] ${msg}`);
     try {
         // ── Step 1: cloudflared binary ──────────────────────────────────
@@ -1034,116 +1048,373 @@ server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare
                 data: { authUrl },
             });
         }
-        // ── Step 3: Zone (domain) check ─────────────────────────────────
-        log(`checking zone for ${domain}`);
-        let zones;
+        // ── Step 3: Discover state — tunnel, zone, domain ───────────────
+        const existingState = cloudflared.getPersistedState();
+        const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
+        // If state already has a tunnel identity with hostnames, labels are
+        // reconstructed from the persisted hostnames on every re-entry where
+        // the agent doesn't supply fresh labels. This is how the flow
+        // survives the awaiting_password round-trip.
+        const stateAdminLabel = existingState?.adminHostname && existingState.domain
+            ? existingState.adminHostname.replace(`.${existingState.domain}`, "")
+            : null;
+        const statePublicLabel = existingState?.publicHostname && existingState?.domain
+            ? existingState.publicHostname.replace(`.${existingState.domain}`, "")
+            : null;
+        let allTunnels = [];
+        let allZones = [];
         try {
-            zones = await cloudflared.listZones();
+            [allTunnels, allZones] = await Promise.all([
+                cloudflared.listTunnelsOnAccount(),
+                cloudflared.listZones(),
+            ]);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            log(`zone list failed: ${msg}`);
-            return result({ status: "error", message: `Could not check your domains: ${msg}` });
+            log(`discovery failed: ${msg}`);
+            return result({
+                status: "error",
+                message: `Could not read your Cloudflare account: ${msg}`,
+            });
         }
-        const zone = zones.find((z) => z.name === domain);
-        if (!zone) {
-            // Zone doesn't exist — try to add it
-            log(`zone ${domain} not found — adding`);
-            try {
-                const created = await cloudflared.createZone(domain);
-                if (created.status === "pending") {
-                    log(`zone ${domain} added but pending — nameservers: ${created.nameservers.join(", ")}`);
+        log(`entry tunnelsOnAccount=${allTunnels.length} zonesOnAccount=${allZones.length}`);
+        const activeZones = allZones.filter((z) => z.status === "active");
+        const pendingZones = allZones.filter((z) => z.status === "pending");
+        // Resolve domain — precedence: persisted state > tunnel selection > zone selection > auto-only-active
+        let domain = existingState?.domain ?? null;
+        if (!domain && selectedTunnelId && selectedTunnelId !== "__new__") {
+            const tunnel = allTunnels.find((t) => t.id === selectedTunnelId);
+            if (!tunnel) {
+                log(`selectedTunnelId ${selectedTunnelId} not found on account`);
+                return result({
+                    status: "error",
+                    message: "That tunnel is no longer on your account. Let me check again.",
+                });
+            }
+            const zoneName = await cloudflared.findZoneHostingTunnel(selectedTunnelId);
+            if (!zoneName) {
+                log(`selected tunnel ${selectedTunnelId} has no zone hosting it — falling back to zone selection`);
+                // Fall through to zone-selection branch below
+            }
+            else {
+                domain = zoneName;
+                log(`branch=existing-tunnel tunnelId=${selectedTunnelId} domain=${domain}`);
+            }
+        }
+        if (!domain && selectedZoneName) {
+            const zone = activeZones.find((z) => z.name === selectedZoneName);
+            if (!zone) {
+                log(`selectedZoneName ${selectedZoneName} not active on account`);
+                return result({
+                    status: "error",
+                    message: "That domain is no longer Active on your account. Let me check again.",
+                });
+            }
+            domain = selectedZoneName;
+        }
+        // No prior state, no selection — prompt the user for a tunnel
+        // (if account has any) or a zone (if account has >1 active zone).
+        if (!domain) {
+            if (allTunnels.length > 0 && !selectedTunnelId) {
+                log(`awaiting_tunnel_selection tunnelsOnAccount=${allTunnels.length}`);
+                const options = [
+                    { value: "__new__", label: "Create a new tunnel (recommended)" },
+                    ...allTunnels.map((t) => ({ value: t.id, label: t.name })),
+                ];
+                return result({
+                    status: "awaiting_tunnel_selection",
+                    message: "Pick a tunnel for this device. For a fresh setup, choose Create a new tunnel.",
+                    data: {
+                        tunnels: allTunnels.map((t) => ({ id: t.id, name: t.name })),
+                        render: {
+                            name: "single-select",
+                            data: {
+                                title: "Tunnel",
+                                description: "Each device uses its own tunnel. Creating a new one is the normal choice.",
+                                options,
+                                submitLabel: "Use this tunnel",
+                                submitMessage: '{"selectedTunnelId":"{{value}}"}',
+                            },
+                        },
+                    },
+                });
+            }
+            // From here: selectedTunnelId is "__new__" or undefined (no tunnels on account).
+            if (activeZones.length === 0) {
+                if (pendingZones.length > 0) {
+                    const z = pendingZones[0];
+                    log(`awaiting_nameservers zone=${z.name}`);
                     return result({
                         status: "awaiting_nameservers",
-                        message: `Your domain has been added to Cloudflare but needs to be activated. Update the nameservers at your registrar to:\n\n• ${created.nameservers[0]}\n• ${created.nameservers[1]}\n\nThis tells your domain to use Cloudflare. The change can take a few minutes to a few hours to take effect. Let me know when you've updated them.`,
-                        data: { nameservers: created.nameservers },
+                        message: `Your domain ${z.name} is on Cloudflare but not yet active. Update the nameservers at your registrar to:\n\n• ${z.nameservers[0]}\n• ${z.nameservers[1]}\n\nLet me know when you've updated them.`,
+                        data: { nameservers: z.nameservers },
                     });
                 }
-                // Active — continue
-                log(`zone ${domain} added and active`);
+                log(`branch=zone-add-fallback reason=noZones`);
+                return result({
+                    status: "awaiting_zone_add_dashboard",
+                    message: "No domain on your Cloudflare account yet. Sign in at cloudflare.com, click Add a site, and add your domain. When it appears on the account, let me know and I'll continue.",
+                    data: { dashboardUrl: "https://dash.cloudflare.com" },
+                });
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`zone creation failed: ${msg}`);
+            if (activeZones.length > 1) {
+                log(`awaiting_zone_selection activeZones=${activeZones.length}`);
                 return result({
-                    status: "error",
-                    message: `Could not add your domain to Cloudflare: ${msg}. You may need to add it manually at cloudflare.com.`,
+                    status: "awaiting_zone_selection",
+                    message: "Multiple domains on your Cloudflare account. Pick the one to use for this device.",
+                    data: {
+                        zones: activeZones.map((z) => ({ name: z.name, status: z.status })),
+                        render: {
+                            name: "single-select",
+                            data: {
+                                title: "Domain",
+                                options: activeZones.map((z) => ({ value: z.name, label: z.name })),
+                                submitLabel: "Use this domain",
+                                submitMessage: '{"selectedZoneName":"{{value}}"}',
+                            },
+                        },
+                    },
                 });
             }
+            // Exactly one active zone — use it.
+            domain = activeZones[0].name;
+            log(`auto-selected only active zone: ${domain}`);
         }
-        else if (zone.status === "pending") {
-            log(`zone ${domain} is pending — nameservers: ${zone.nameservers.join(", ")}`);
+        // Verify the resolved zone is active (guard against state with a since-pending zone)
+        const zone = allZones.find((z) => z.name === domain);
+        if (zone && zone.status === "pending") {
+            log(`zone ${domain} is pending — returning awaiting_nameservers`);
             return result({
                 status: "awaiting_nameservers",
-                message: `Your domain is on Cloudflare but not yet active. Update the nameservers at your registrar to:\n\n• ${zone.nameservers[0]}\n• ${zone.nameservers[1]}\n\nLet me know when you've updated them.`,
+                message: `Your domain ${domain} is not yet active on Cloudflare. Update the nameservers at your registrar to:\n\n• ${zone.nameservers[0]}\n• ${zone.nameservers[1]}\n\nLet me know when you've updated them.`,
                 data: { nameservers: zone.nameservers },
             });
         }
-        else {
-            log(`zone ${domain} is ${zone.status}`);
+        // ── Step 4: Labels ──────────────────────────────────────────────
+        // Resolution precedence: args > persisted state hostnames.
+        const resolvedAdminLabel = adminLabel ?? stateAdminLabel;
+        const resolvedPublicLabel = publicLabel ?? statePublicLabel ?? null;
+        if (!resolvedAdminLabel) {
+            log(`ui=tunnel-route-picker rendered tunnelDomain=${domain}`);
+            return result({
+                status: "awaiting_labels",
+                message: `Pick a short name for your admin address on ${domain}. You can also pick one for a public address, or leave it empty.`,
+                data: {
+                    domain,
+                    render: {
+                        name: "tunnel-route-picker",
+                        data: {
+                            domain,
+                            title: "Pick your addresses",
+                            description: "Your admin address is required. Public is optional and can be added later.",
+                            submitLabel: "Set up addresses",
+                        },
+                    },
+                },
+            });
         }
-        // ── Step 4: Tunnel creation ─────────────────────────────────────
-        log("checking tunnel");
-        const existingState = cloudflared.getPersistedState();
-        const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
-        // Build hostname list from subdomains
-        const adminHostname = `${adminSubdomain}.${domain}`;
-        const publicHostname = publicSubdomain ? `${publicSubdomain}.${domain}` : null;
+        // Defense-in-depth label validation (UI already filters, but tool
+        // is authoritative — an agent misroute must fail loudly, not silently).
+        if (!LABEL_RE.test(resolvedAdminLabel)) {
+            log(`invalid admin label: ${resolvedAdminLabel}`);
+            return result({
+                status: "label-taken",
+                message: "Admin label is not a valid DNS label. Pick something that is lowercase letters, numbers, and hyphens.",
+                data: {
+                    domain,
+                    field: "admin",
+                    render: {
+                        name: "tunnel-route-picker",
+                        data: {
+                            domain,
+                            title: "Pick your addresses",
+                            defaultAdmin: "",
+                            defaultPublic: resolvedPublicLabel ?? "",
+                            error: { field: "admin", message: "Not a valid address — use lowercase letters, numbers, and hyphens." },
+                            submitLabel: "Set up addresses",
+                        },
+                    },
+                },
+            });
+        }
+        if (resolvedPublicLabel !== null && resolvedPublicLabel !== "" && !LABEL_RE.test(resolvedPublicLabel)) {
+            log(`invalid public label: ${resolvedPublicLabel}`);
+            return result({
+                status: "label-taken",
+                message: "Public label is not a valid DNS label.",
+                data: {
+                    domain,
+                    field: "public",
+                    render: {
+                        name: "tunnel-route-picker",
+                        data: {
+                            domain,
+                            defaultAdmin: resolvedAdminLabel,
+                            defaultPublic: "",
+                            error: { field: "public", message: "Not a valid address." },
+                            submitLabel: "Set up addresses",
+                        },
+                    },
+                },
+            });
+        }
+        if (resolvedPublicLabel && resolvedAdminLabel === resolvedPublicLabel) {
+            log(`admin and public labels identical: ${resolvedAdminLabel}`);
+            return result({
+                status: "label-taken",
+                message: "Admin and public addresses must differ.",
+                data: {
+                    domain,
+                    field: "public",
+                    render: {
+                        name: "tunnel-route-picker",
+                        data: {
+                            domain,
+                            defaultAdmin: resolvedAdminLabel,
+                            defaultPublic: "",
+                            error: { field: "public", message: "Public must differ from admin." },
+                            submitLabel: "Set up addresses",
+                        },
+                    },
+                },
+            });
+        }
+        const adminHostname = `${resolvedAdminLabel}.${domain}`;
+        const publicHostname = resolvedPublicLabel ? `${resolvedPublicLabel}.${domain}` : null;
         const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
-        if (!existingState?.tunnelId) {
-            log(`no tunnel — creating with hostnames=${JSON.stringify(hostnames)}`);
-            const tunnelName = domain.replace(/\./g, "-");
-            try {
-                const tunnel = cloudflared.createTunnelCli(tunnelName);
-                // Collision guard
-                for (const h of hostnames) {
-                    const check = await cloudflared.checkDnsCollision(h, tunnel.tunnelId);
-                    if (check.collision) {
-                        log(`collision detected: ${h} → tunnel ${check.existingTunnelId}`);
-                        return result({
-                            status: "error",
-                            message: `DNS collision: ${h} already points to a different tunnel. This hostname belongs to another device. Choose a different subdomain.`,
-                        });
-                    }
+        // ── Step 5: Resolve or create tunnel (idempotent on re-entry) ───
+        let tunnelId = existingState?.tunnelId ?? null;
+        let tunnelName = existingState?.tunnelName ?? null;
+        let credentialsPath = existingState?.credentialsPath ?? null;
+        if (!tunnelId) {
+            if (selectedTunnelId && selectedTunnelId !== "__new__") {
+                // User picked an existing tunnel — reuse its identity.
+                const selected = allTunnels.find((t) => t.id === selectedTunnelId);
+                if (!selected) {
+                    return result({
+                        status: "error",
+                        message: "Selected tunnel not found on account.",
+                    });
                 }
-                const configPath = cloudflared.writeLocalConfig(tunnel.tunnelId, tunnel.credentialsPath, hostnames, platformPort);
-                cloudflared.saveTunnelIdentity({
-                    tunnelId: tunnel.tunnelId,
-                    tunnelName: tunnel.tunnelName,
-                    domain,
-                    configPath,
-                    credentialsPath: tunnel.credentialsPath,
-                    adminHostname,
-                    publicHostname,
-                });
-                // Route DNS for each hostname
-                for (const h of hostnames) {
-                    cloudflared.routeDnsCli(tunnel.tunnelId, h);
+                if (!hasBrandCredsFor(selected.id)) {
+                    // Cannot reuse without credentials — this tunnel belongs to
+                    // another device on the same account. Surface structured error.
+                    log(`collision type=tunnel-name label=${resolvedAdminLabel} existingTunnelId=${selected.id}`);
+                    return result({
+                        status: "tunnel-name-taken",
+                        message: `The tunnel "${selected.name}" belongs to another device. Pick a different label for this one.`,
+                        data: {
+                            suggestedLabel: `${resolvedAdminLabel}2`,
+                            existingTunnelId: selected.id,
+                            render: {
+                                name: "tunnel-route-picker",
+                                data: {
+                                    domain,
+                                    defaultAdmin: "",
+                                    defaultPublic: resolvedPublicLabel ?? "",
+                                    error: { field: "admin", message: `That address is already taken. Pick a different one.` },
+                                    submitLabel: "Set up addresses",
+                                },
+                            },
+                        },
+                    });
                 }
-                log(`tunnel ${tunnel.tunnelId} created, DNS routed for ${JSON.stringify(hostnames)}`);
+                tunnelId = selected.id;
+                tunnelName = selected.name;
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`tunnel creation failed: ${msg}`);
-                return result({ status: "error", message: `Could not create the tunnel: ${msg}` });
+            else {
+                // Create new — tunnel name is derived from admin label + domain.
+                const derivedName = deriveTunnelName(resolvedAdminLabel, domain);
+                log(`branch=new-tunnel zoneName=${domain} tunnelName=${derivedName}`);
+                const accountExisting = allTunnels.find((t) => t.name === derivedName);
+                if (accountExisting && !hasBrandCredsFor(accountExisting.id)) {
+                    log(`collision type=tunnel-name label=${resolvedAdminLabel} existingTunnelId=${accountExisting.id}`);
+                    return result({
+                        status: "tunnel-name-taken",
+                        message: `The address ${resolvedAdminLabel}.${domain} is already in use by another device. Pick a different one.`,
+                        data: {
+                            domain,
+                            suggestedLabel: `${resolvedAdminLabel}2`,
+                            existingTunnelId: accountExisting.id,
+                            field: "admin",
+                            render: {
+                                name: "tunnel-route-picker",
+                                data: {
+                                    domain,
+                                    defaultAdmin: "",
+                                    defaultPublic: resolvedPublicLabel ?? "",
+                                    error: { field: "admin", message: `That address is already taken — pick a different one.` },
+                                    submitLabel: "Set up addresses",
+                                },
+                            },
+                        },
+                    });
+                }
+                try {
+                    const created = cloudflared.createTunnelCli(derivedName);
+                    tunnelId = created.tunnelId;
+                    tunnelName = created.tunnelName;
+                    credentialsPath = created.credentialsPath;
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    log(`tunnel creation failed: ${msg}`);
+                    return result({ status: "error", message: `Could not create the tunnel: ${msg}` });
+                }
             }
         }
-        else {
-            log(`tunnel exists: ${existingState.tunnelId}`);
-            // Ensure domain and hostnames are persisted in state (may be stale)
-            if (existingState.domain !== domain || existingState.adminHostname !== adminHostname) {
-                cloudflared.saveTunnelIdentity({
-                    tunnelId: existingState.tunnelId,
-                    tunnelName: existingState.tunnelName,
-                    domain,
-                    configPath: existingState.configPath,
-                    credentialsPath: existingState.credentialsPath,
-                    adminHostname,
-                    publicHostname,
+        if (!tunnelId || !tunnelName) {
+            return result({ status: "error", message: "Tunnel identity could not be resolved." });
+        }
+        // Fallback credentials path when reusing a tunnel picked from the UI:
+        // createTunnelCli already copies from ~/.cloudflared to the brand dir,
+        // but that runs only in the create branch. For the "reuse existing"
+        // branch, derive the same brand-dir path here.
+        if (!credentialsPath) {
+            credentialsPath = join(homedir(), cloudflared.loadBrand().configDir, "cloudflared", `${tunnelId}.json`);
+        }
+        // ── Step 6: DNS routing + config (idempotent every call) ────────
+        for (const h of hostnames) {
+            const check = await cloudflared.checkDnsCollision(h, tunnelId);
+            if (check.collision) {
+                const offendingField = h === adminHostname ? "admin" : "public";
+                log(`collision type=label hostname=${h} existingTunnelId=${check.existingTunnelId}`);
+                return result({
+                    status: "label-taken",
+                    message: `The address ${h} already points to a different tunnel. Pick a different ${offendingField} label.`,
+                    data: {
+                        domain,
+                        field: offendingField,
+                        existingTunnelId: check.existingTunnelId ?? undefined,
+                        render: {
+                            name: "tunnel-route-picker",
+                            data: {
+                                domain,
+                                defaultAdmin: offendingField === "admin" ? "" : resolvedAdminLabel,
+                                defaultPublic: offendingField === "public" ? "" : (resolvedPublicLabel ?? ""),
+                                error: { field: offendingField, message: `That address is already in use by another device.` },
+                                submitLabel: "Set up addresses",
+                            },
+                        },
+                    },
                 });
             }
         }
-        // ── Step 5: Remote auth check ───────────────────────────────────
+        const configPath = cloudflared.writeLocalConfig(tunnelId, credentialsPath, hostnames, platformPort);
+        cloudflared.saveTunnelIdentity({
+            tunnelId,
+            tunnelName,
+            domain,
+            configPath,
+            credentialsPath,
+            adminHostname,
+            publicHostname,
+        });
+        for (const h of hostnames) {
+            cloudflared.routeDnsCli(tunnelId, h);
+        }
+        log(`ui=tunnel-route-picker submitted adminLabel=${resolvedAdminLabel} publicLabel=${resolvedPublicLabel ?? "null"}`);
+        // ── Step 7: Remote auth check ───────────────────────────────────
         // scrypt hashing on Pi ARM takes 2-5s after form submission —
         // wait before checking to avoid a false negative on every first attempt
         log("waiting 3s for scrypt hash before checking remote auth");
@@ -1172,7 +1443,7 @@ server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare
                 message: "Could not verify remote access password — the platform may not be running. Make sure it's started and try again.",
             });
         }
-        // ── Step 6: Tunnel enable ───────────────────────────────────────
+        // ── Step 8: Tunnel enable ───────────────────────────────────────
         const tunnelState = cloudflared.getPersistedState();
         if (!tunnelState) {
             return result({ status: "error", message: "Tunnel state lost — please try again." });
@@ -1204,6 +1475,7 @@ server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare
                 // Verify admin URL is reachable through Cloudflare edge
                 const verifyUrl = `https://${adminHostname}`;
                 let verified = false;
+                let lastStatus = null;
                 for (let attempt = 0; attempt < 6; attempt++) {
                     if (attempt > 0)
                         await new Promise((r) => setTimeout(r, 5000));
@@ -1212,8 +1484,10 @@ server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare
                             signal: AbortSignal.timeout(10000),
                             redirect: "manual",
                         });
+                        lastStatus = res.status;
                         if (res.status !== 530) {
                             verified = true;
+                            log(`verified url=${verifyUrl} status=${res.status}`);
                             break;
                         }
                     }
@@ -1222,7 +1496,7 @@ server.tool("cloudflare-setup", "Deterministic state machine for full Cloudflare
                     }
                 }
                 if (!verified) {
-                    log(`tunnel running but ${verifyUrl} not reachable (HTTP 530)`);
+                    log(`verified url=${verifyUrl} status=${lastStatus ?? "timeout"} result=unreachable`);
                     return result({
                         status: "error",
                         message: `The tunnel is running but the admin URL is not reachable yet. This usually resolves in a few minutes as DNS propagates. Try again shortly.`,