@rubytech/create-realagent 1.0.619 → 1.0.621

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -3,21 +3,82 @@ initStderrTee("cloudflare");
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { join } from "node:path";
-import { hostname, homedir } from "node:os";
-import { existsSync } from "node:fs";
+import { Resolver } from "node:dns/promises";
 import * as cloudflared from "./lib/cloudflared.js";
 const server = new McpServer({
     name: "cloudflare",
-    version: "0.2.0",
+    version: "0.3.0",
 });
+// ---------------------------------------------------------------------------
+// tunnel-status trailing guidance — deterministic 1:1 mapping from status
+// enum → single prescribed recovery sentence.
+//
+// The trailing string is a prompt for the agent's next turn. Task 541 closed
+// the recurrence loop where a "check in the browser" sentence primed a 44-
+// tool-call dashboard cascade. The mapping here is exhaustive for every
+// reachable `unhealthyReason`; there is no generic fallback branch. Each
+// sentence names exactly one next action so the agent cannot fork on it.
+// ---------------------------------------------------------------------------
+const BOUND_ACCOUNT_MISMATCH_SENTENCE = (hostname) => `Sign in to Cloudflare at dash.cloudflare.com in the account that owns ${hostname} — ` +
+    `the account with the little orange cloud next to it in your browser tab — then tell me ` +
+    `and I'll restart the tunnel login.`;
+function buildTunnelStatusGuidance(status) {
+    if (!status.unhealthyReason)
+        return "";
+    if (status.unhealthyReason === "not-running") {
+        return `\n\nThe tunnel process is not running. Ask the user if they want me to enable it.`;
+    }
+    if (status.unhealthyReason === "no-tunnel-configured") {
+        return `\n\nNo tunnel is configured on this laptop yet. Run tunnel-create to set one up.`;
+    }
+    if (status.unhealthyReason === "bound-account-does-not-own-hostname") {
+        // Use the first configured hostname as the anchor — matches how the
+        // operator thinks about the setup. If configuredHostnames is empty
+        // (unreachable here because the enum is only set when probes ran)
+        // fall back to domain.
+        const anchor = status.configuredHostnames[0] ??
+            status.persistedHostnames[0] ??
+            status.domain ??
+            "your domain";
+        return `\n\n${BOUND_ACCOUNT_MISMATCH_SENTENCE(anchor)}`;
+    }
+    if (status.unhealthyReason === "hostname-probes-failed") {
+        // Dominant per-hostname mode drives the sentence. All failing probes
+        // share one mode in the expected failure classes — when they diverge,
+        // the first failure wins (the per-hostname list is already printed in
+        // the JSON above; the sentence names the one action the agent takes).
+        const firstFailure = status.probes.find((p) => p.failureMode !== "ok");
+        const mode = firstFailure?.failureMode ?? "edge-unreachable";
+        if (mode === "tunnel-not-matched" || mode === "cname-points-elsewhere") {
+            return `\n\nDNS is pointing at a different tunnel. I'll re-point it.`;
+        }
+        if (mode === "dns-missing") {
+            return `\n\nDNS is not set up yet. I'll create it.`;
+        }
+        // edge-unreachable — transient Cloudflare edge or connectivity; the
+        // agent should not immediately re-probe or open the dashboard.
+        return `\n\nThe tunnel is not reachable through Cloudflare right now. This usually clears in a minute.`;
+    }
+    // Exhaustiveness guard — a new enum value must be added to this switch
+    // before it ever appears in a tool result. Returning empty string would
+    // let a novel failure mode silently emit JSON-only output. The bare
+    // assignment (no `as never` cast) is the point: TypeScript narrows
+    // `status.unhealthyReason` to `never` after every branch above returns,
+    // so a new `TunnelUnhealthyReason` value introduced without a branch
+    // here fails at compile time.
+    const _exhaustive = status.unhealthyReason;
+    console.error(`[cloudflare:tunnel-status:unknown-reason] reason=${String(_exhaustive)}`);
+    return "";
+}
 // ===================================================================
-// Authentication — cert.pem only
+// Authentication — OAuth cert.pem only
 //
-// The plugin recognises exactly one CF account identity: the one
-// cert.pem was bound to via OAuth. `tunnel-login` is the only auth
-// path; the binding written on success is the device's record of
-// which account it currently speaks to.
+// The plugin recognises exactly one identity: the Cloudflare account
+// cert.pem was bound to via `cloudflared tunnel login`. No API token
+// handling, no SDK, no read of account state by any code path. The
+// operator's logged-in Cloudflare dashboard session is the source of
+// truth for which domains exist and who owns them; the agent's role
+// is to instruct the operator where to click.
 // ===================================================================
 server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunnel login`. Three phases: (1) if cert.pem exists and matches the recorded account binding, reports status; (2) if cert.pem exists but no binding has been recorded, materializes the binding from the cert (migration path); (3) if no cert.pem, spawns login process and returns the auth URL. Detects existing login processes — safe to call repeatedly without spawning duplicates. Pass force=true to delete cert.pem (both brand-specific and legacy paths) and account-binding.json before re-authenticating — required when switching Cloudflare accounts.", {
     force: z
@@ -26,26 +87,22 @@ server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunne
         .describe("Delete cert.pem (brand path + legacy ~/.cloudflared/cert.pem) and account-binding.json before re-authenticating. Required when switching Cloudflare accounts (e.g. after the prior account was scrubbed or the cert was rotated under a different account)."),
 }, async ({ force }) => {
     try {
-        // Force: delete cert.pem (both paths) and binding before restarting
         if (force) {
             console.error("[tunnel-login] force=true — clearing cert.pem and account binding before re-auth");
             cloudflared.resetAuth();
         }
         const auth = cloudflared.validateAuth();
-        // Phase: Already bound — cert + binding present and accountIds agree
         if (auth.bound) {
-            console.error(`[tunnel-login] short-circuit: cert and binding agree on account ${auth.boundAccountId}`);
+            console.error(`[cloudflare:tunnel-login:complete] accountId=${auth.boundAccountId}`);
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Already authenticated. cert.pem and account binding agree on account ${auth.boundAccountId}.\n\nTo switch Cloudflare accounts, call tunnel-login with force=true. This deletes cert.pem (both paths) and the account binding, then restarts the authentication flow.`,
+                        text: `Sign-in complete.`,
                     },
                 ],
             };
         }
-        // Phase: cert.pem exists — derive credentials and either materialize
-        // or reconcile the binding.
         if (auth.hasCert) {
             const creds = cloudflared.parseCertPem();
             if (!creds) {
@@ -53,210 +110,138 @@ server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunne
                     content: [
                         {
                             type: "text",
-                            text: `cert.pem exists but could not extract API credentials from it. The file format may have changed.\n\nRecovery: run tunnel-login with force=true to clear cert.pem and re-authenticate.`,
+                            text: `Sign-in file exists but its contents are unreadable. Ask me to run tunnel-login with force=true so the file is cleared and a fresh sign-in can start.`,
                         },
                     ],
                     isError: true,
                 };
             }
-            // Migration path: cert exists, no binding yet — silently materialize
-            // (the operator already trusted this cert by completing the prior
-            // OAuth flow; we don't re-confirm).
             if (!auth.hasBinding) {
-                const binding = cloudflared.materializeBinding("migration");
+                cloudflared.materializeBinding("migration");
+                console.error(`[cloudflare:tunnel-login:complete] accountId=${auth.certAccountId} source=migration`);
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `Account binding materialized from existing cert.pem.\n\n  Account: ${binding.accountId}\n  Bound at: ${binding.boundAt}\n\nReady for tunnel operations.`,
+                            text: `Sign-in complete.`,
                         },
                     ],
                 };
             }
-            // Drift: cert says account X, binding says account Y — refuse with
-            // recovery instruction (force=true will clear both).
             if (auth.certAccountId !== auth.boundAccountId) {
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `cert.pem is bound to account ${auth.certAccountId} but the recorded binding is account ${auth.boundAccountId}. The cert was rotated under a different Cloudflare account since the binding was established.\n\n${cloudflared.recoveryMessage()}`,
+                            text: `The Cloudflare sign-in on this laptop has changed since it was first set up. ${cloudflared.recoveryMessage()}`,
                         },
                     ],
                     isError: true,
                 };
             }
         }
-        // Phase: Login process already running — wait for authorization
-        const activeLogin = cloudflared.getActiveLogin();
-        if (activeLogin) {
+        if (!cloudflared.isInstalled()) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Authorization in progress — a login process is already running (PID ${activeLogin.pid}, started ${new Date(activeLogin.startedAt).toISOString()}).\n\nAuth URL: ${activeLogin.authUrl}\n\nAsk the user to complete authorization in the browser. Call tunnel-login again after the user has authorized — it will detect cert.pem and derive API credentials automatically.`,
+                        text: "cloudflared is not installed. Run tunnel-install first.",
                     },
                 ],
+                isError: true,
             };
         }
-        // Phase: No cert.pem, no active login — spawn cloudflared tunnel login
-        if (!cloudflared.isInstalled()) {
+        // Three-state login machine. `complete` is already handled above via
+        // `auth.bound` / migration path, so here we branch on in-progress vs.
+        // the two restart cases (log-visible failure, PID-dead without cert).
+        const loginStatus = cloudflared.getLoginStatus();
+        if (loginStatus.state === "failed") {
+            console.error(`[cloudflare:tunnel-login:failed] reason=${loginStatus.reason} ` +
+                `pid=${loginStatus.loginState?.pid ?? "none"} marker=${JSON.stringify(loginStatus.marker)}`);
+            cloudflared.resetAuth();
+            const restarted = await cloudflared.tunnelLogin();
             return {
                 content: [
                     {
                         type: "text",
-                        text: "cloudflared is not installed. Run tunnel-install first.",
+                        text: `Sign-in failed — the browser didn't open on the laptop. Restarting.\n\n` +
+                            `Sign-in URL: ${restarted.authUrl}\n\n` +
+                            `Ask the user to open the URL, pick the Cloudflare account they want this laptop signed into, and click Authorize. ` +
+                            `Call tunnel-login again once they confirm — it will detect the completed sign-in automatically.`,
                     },
                 ],
-                isError: true,
             };
         }
-        const result = await cloudflared.tunnelLogin();
-        const alreadyNote = result.alreadyRunning
-            ? " (reusing existing login process)"
-            : "";
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Cloudflare login started${alreadyNote}. Open this URL to authorize:\n\n${result.authUrl}\n\nThe user must open this URL and click Authorize. After authorization, call tunnel-login again — it will detect the authorization and derive API credentials automatically.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Login failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("cf-zone-status", "List all zones (domains) on the Cloudflare account with their activation status and assigned nameservers.", {}, async () => {
-    try {
-        const zones = await cloudflared.listZones();
-        if (zones.length === 0) {
+        if (loginStatus.state === "exited-no-cert") {
+            console.error(`[cloudflare:tunnel-login:failed] reason=login-process-exited-without-cert ` +
+                `pid=${loginStatus.loginState?.pid ?? "none"}`);
+            cloudflared.resetAuth();
+            const restarted = await cloudflared.tunnelLogin();
             return {
                 content: [
                     {
                         type: "text",
-                        text: "No zones found on this account. Add a domain to Cloudflare first.",
+                        text: `Sign-in ended without saving the cert. Restarting.\n\n` +
+                            `Sign-in URL: ${restarted.authUrl}\n\n` +
+                            `Ask the user to open the URL, pick the Cloudflare account they want this laptop signed into, and click Authorize. ` +
+                            `Call tunnel-login again once they confirm — it will detect the completed sign-in automatically.`,
                     },
                 ],
             };
         }
-        const lines = zones.map((z) => `  ${z.name} — ${z.status}${z.nameservers.length > 0 ? `\n    Nameservers: ${z.nameservers.join(", ")}` : ""}`);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Zones on this account:\n\n${lines.join("\n\n")}`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("cf-add-zone", "Add a domain to the bound Cloudflare account via the official API. Idempotent: returns existing zone info if already on the account. Requires a successful tunnel-login (cert.pem + account-binding.json present and matching). The bound account must have permission to create zones; if not, the operator must add the zone via the Cloudflare dashboard.", {
-    domain: z
-        .string()
-        .describe("Registrable domain to add to the bound Cloudflare account (e.g. 'mybusiness.com')."),
-}, async ({ domain }) => {
-    try {
-        const start = Date.now();
-        const result = await cloudflared.createZone(domain);
-        const elapsed = Date.now() - start;
-        const action = result.existing ? "already on this account" : "added";
-        const nsLines = result.nameservers.length > 0
-            ? `\n  Nameservers: ${result.nameservers.join(", ")}`
-            : "";
-        console.error(`[cf-add-zone] ${domain} ${action} (${result.status}) in ${elapsed}ms`);
+        if (loginStatus.state === "in-progress") {
+            console.error(`[cloudflare:tunnel-login:waiting] pid=${loginStatus.loginState.pid} authUrl=${loginStatus.loginState.authUrl}`);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Sign-in in progress — a browser window is already open (started ${new Date(loginStatus.loginState.startedAt).toISOString()}).\n\n` +
+                            `Sign-in URL: ${loginStatus.loginState.authUrl}\n\n` +
+                            `Ask the user to finish the sign-in in their browser and click Authorize. ` +
+                            `Call tunnel-login again once the user confirms — it will detect the completed sign-in automatically.`,
+                    },
+                ],
+            };
+        }
+        // state === "idle" — spawn fresh.
+        const result = await cloudflared.tunnelLogin();
         return {
             content: [
                 {
                     type: "text",
-                    text: `Domain ${action}.\n\n  Domain: ${result.name}\n  Status: ${result.status}${nsLines}\n\n${result.status === "pending"
-                        ? "The domain is pending activation — update the nameservers at your registrar to the Cloudflare-assigned nameservers shown above. Once nameservers propagate (minutes to 24 hours), the status changes to Active."
-                        : result.status === "active"
-                            ? "The domain is active on Cloudflare."
-                            : `Current status: ${result.status}.`}`,
+                    text: `Cloudflare sign-in started. Open this URL to authorize:\n\n${result.authUrl}\n\n` +
+                        `Ask the user to open the URL, pick the Cloudflare account they want this laptop signed into, and click Authorize. ` +
+                        `Call tunnel-login again once they confirm — it will detect the completed sign-in automatically.`,
                 },
             ],
         };
     }
     catch (err) {
-        // Refusal-shaped errors thrown by getClient() carry structured detail —
-        // surface them as agent-facing refusals with the same single recovery path.
-        if (err instanceof cloudflared.CloudflareRefusalError) {
-            return {
-                content: [{ type: "text", text: err.refusal.message }],
-                isError: true,
-            };
-        }
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[cf-add-zone] failed for ${domain}: ${msg}`);
         return {
             content: [
                 {
                     type: "text",
-                    text: `Zone creation failed: ${msg}\n\n` +
-                        `If this looks like a permissions error, the cert.pem account may not own ` +
-                        `this brand's zones. ${cloudflared.recoveryMessage()}`,
+                    text: `Sign-in failed: ${err instanceof Error ? err.message : String(err)}`,
                 },
             ],
             isError: true,
         };
     }
 });
-// ===================================================================
-// Cloudflare Tunnel tools
-// ===================================================================
-server.tool("tunnel-status", "Full Cloudflare Tunnel status: installed, version, token valid, running, domain, hostnames.", {
+server.tool("tunnel-status", "End-to-end Cloudflare Tunnel status. Reads the tunnel process state, parses configured hostnames from config.yml, and probes each hostname (DNS + HTTPS via Cloudflare's edge) to confirm traffic actually reaches this laptop from the internet. `healthy: true` requires every configured hostname to probe `ok`. `boundAccountOwnsHostnames: false` means the laptop is running a tunnel that nothing on the internet can reach — almost always because it is signed into a Cloudflare account that does not own the domain.", {
     domain: z
         .string()
         .optional()
-        .describe("The bare domain (e.g. 'maxy.bot'). If omitted, domain info is excluded."),
+        .describe("The bare domain (e.g. 'maxy.bot'). If omitted, derived from persisted state."),
 }, async ({ domain }) => {
     try {
         const status = await cloudflared.getStatus(domain);
-        // Check if the actual hostnames resolve (from state, not hardcoded)
-        let dnsWarning = "";
-        if (status.hostnames.length > 0) {
-            const dns = await import("node:dns/promises");
-            const resolver = new dns.Resolver();
-            resolver.setServers(["8.8.8.8", "1.1.1.1"]);
-            const checks = [];
-            for (const h of status.hostnames) {
-                try {
-                    await resolver.resolve4(h);
-                }
-                catch {
-                    checks.push(h);
-                }
-            }
-            if (checks.length > 0) {
-                dnsWarning = `\n\nDNS NOT RESOLVING: ${checks.join(", ")} do not resolve (checked via Google DNS 8.8.8.8). Possible causes: (1) CNAME records not created — run tunnel-create to create them; (2) nameservers not pointing to Cloudflare — check cf-zone-status; (3) DNS propagation in progress — wait a few minutes and re-check.`;
-            }
-        }
+        const guidance = buildTunnelStatusGuidance(status);
         return {
             content: [
                 {
                     type: "text",
-                    text: JSON.stringify(status, null, 2) + dnsWarning,
+                    text: JSON.stringify(status, null, 2) + guidance,
                 },
             ],
         };
@@ -317,7 +302,7 @@ server.tool("tunnel-install", "Install the cloudflared binary if not already pre
         };
     }
 });
-server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the specified subdomains. The admin subdomain is required (e.g. 'admin' → admin.{domain}, 'joel' → joel.{domain}). The public subdomain is optional — omit to skip the public endpoint. Collision guard: refuses to create DNS records that would overwrite another tunnel's hostnames. Uses cloudflared CLI with cert.pem — requires tunnel-login first. Idempotent — reuses existing tunnel if name matches.", {
+server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the specified subdomains. The admin subdomain is required (e.g. 'admin' → admin.{domain}, 'joel' → joel.{domain}). The public subdomain is optional — omit to skip the public endpoint. Shells out to `cloudflared` which uses the signed-in cert.pem; refuses when the configured domain is not on the signed-in Cloudflare account. Idempotent — reuses existing tunnel if name matches.", {
     domain: z
         .string()
         .describe("The bare domain (e.g. 'maxy.bot')."),
@@ -335,7 +320,6 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         .optional()
         .describe("Human-readable tunnel name (default: derived from domain)"),
 }, async ({ domain, adminSubdomain, publicSubdomain, tunnelName }) => {
-    // Validate: admin and public subdomains must differ
     if (publicSubdomain && adminSubdomain === publicSubdomain) {
         return {
             content: [
@@ -348,35 +332,27 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         };
     }
     try {
+        const auth = cloudflared.validateAuth();
+        if (!auth.bound) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `REFUSED: this laptop is not signed into Cloudflare yet. ${cloudflared.recoveryMessage()}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
         const name = tunnelName ?? domain.replace(/\./g, "-");
         const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
-        // Build hostname list from subdomains
         const adminHostname = `${adminSubdomain}.${domain}`;
         const publicHostname = publicSubdomain ? `${publicSubdomain}.${domain}` : null;
         const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
         console.error(`[tunnel-create] hostnames=${JSON.stringify(hostnames)} domain=${domain}`);
-        // Live account-zone check happens inside routeDnsCli (Step 4 below).
-        // getClient() inside routeDnsCli enforces auth pre-conditions
-        // (cert + binding + accountId match).
         // Step 1: Create tunnel via CLI (idempotent — reuses if name exists)
         const tunnel = cloudflared.createTunnelCli(name);
-        // Step 2: Collision guard — check each hostname before creating DNS records
-        for (const h of hostnames) {
-            const check = await cloudflared.checkDnsCollision(h, tunnel.tunnelId);
-            if (check.collision) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `DNS collision: ${h} already points to a different tunnel (${check.existingTunnelId}). ` +
-                                `This hostname belongs to another device. Choose a different subdomain or remove the existing DNS record first.`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-        }
-        // Step 3: Write local config.yml with ingress rules
+        // Step 2: Write local config.yml with ingress rules
         const configPath = cloudflared.writeLocalConfig(tunnel.tunnelId, tunnel.credentialsPath, hostnames, platformPort);
         // Persist tunnel identity with actual hostnames
         cloudflared.saveTunnelIdentity({
@@ -388,21 +364,19 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
             adminHostname,
             publicHostname,
         });
-        // Step 4: Route DNS via CLI for each hostname
+        // Step 3: Route DNS via CLI for each hostname (pre-flight + post-flight in routeDnsCli)
         const dnsResults = [];
         for (const h of hostnames) {
             const route = await cloudflared.routeDnsCli(tunnel.tunnelId, h);
             dnsResults.push({
                 hostname: h,
                 fqdn: route.fqdn,
-                zone: route.zone,
                 note: route.created ? "created" : "already existed",
             });
         }
-        // Step 5: Verify hostnames resolve via Google DNS
-        const dns = await import("node:dns/promises");
-        const resolver = new dns.Resolver();
-        resolver.setServers(["8.8.8.8", "1.1.1.1"]);
+        // Step 4: Verify hostnames resolve via public DNS
+        const resolver = new Resolver();
+        resolver.setServers(["1.1.1.1", "8.8.8.8"]);
         const dnsWarnings = [];
         for (const h of hostnames) {
             try {
@@ -414,16 +388,16 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         }
         let dnsNote = "";
         if (dnsWarnings.length > 0) {
-            dnsNote = `\n\nDNS WARNING: ${dnsWarnings.join(", ")} did not resolve via Google DNS (8.8.8.8). This may be propagation delay (wait a few minutes and re-check) or the domain may not be Active on Cloudflare — run cf-zone-status to check.`;
+            dnsNote = `\n\nDNS WARNING: ${dnsWarnings.join(", ")} did not resolve via public DNS yet. DNS propagation typically takes 1-5 minutes. Re-run tunnel-status in a few minutes to confirm.`;
         }
         const dnsLines = dnsResults
-            .map((r) => `  DNS: ${r.hostname} → ${tunnel.tunnelId}.cfargotunnel.com under zone ${r.zone} (${r.note})${r.fqdn !== r.hostname ? ` — WARNING: CNAME created as ${r.fqdn}` : ""}`)
+            .map((r) => `  ${r.hostname} → this tunnel (${r.note})`)
             .join("\n");
         return {
             content: [
                 {
                     type: "text",
-                    text: `Tunnel created.\n\n  ID: ${tunnel.tunnelId}\n  Name: ${tunnel.tunnelName}\n${dnsLines}\n  Config: ${configPath}\n\nUse tunnel-enable to start the tunnel.${dnsNote}`,
+                    text: `Tunnel created.\n\n  Name: ${tunnel.tunnelName}\n${dnsLines}\n  Config: ${configPath}\n\nUse tunnel-enable to start the tunnel.${dnsNote}`,
                 },
             ],
         };
@@ -451,7 +425,6 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
     domain: z.string().optional().describe("The bare domain (e.g. 'maxy.bot'). If omitted, reads from persisted tunnel state."),
 }, async ({ tunnelId: tunnelIdParam, domain: domainParam }) => {
     try {
-        // Resolve tunnelId and domain from params or persisted state
         const tunnelId = tunnelIdParam ?? cloudflared.getPersistedTunnelId();
         const domain = domainParam ?? cloudflared.getPersistedDomain();
         if (!tunnelId) {
@@ -459,7 +432,7 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 content: [
                     {
                         type: "text",
-                        text: "No tunnel ID provided and none found in persisted state. Run tunnel-create first to create a tunnel.",
+                        text: "No tunnel found on this laptop. Run tunnel-create first.",
                     },
                 ],
                 isError: true,
@@ -470,30 +443,28 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 content: [
                     {
                         type: "text",
-                        text: "No domain provided and none found in persisted state. Run tunnel-create first to create a tunnel with a domain.",
+                        text: "No domain recorded for this tunnel. Run tunnel-create first to set one up with a domain.",
                     },
                 ],
                 isError: true,
             };
         }
-        // Read actual hostnames from persisted state (backward compat: derives from domain)
         const hostnames = cloudflared.getPersistedHostnames();
         if (hostnames.length === 0) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: "No hostnames found in persisted state. Run tunnel-create first.",
+                        text: "No addresses recorded for this tunnel. Run tunnel-create first.",
                     },
                 ],
                 isError: true,
             };
         }
         console.error(`[tunnel-enable] checking hostnames=${JSON.stringify(hostnames)}`);
-        // GATE 1: Check if actual hostnames resolve (via Google DNS)
-        const dns = await import("node:dns/promises");
-        const resolver = new dns.Resolver();
-        resolver.setServers(["8.8.8.8", "1.1.1.1"]);
+        // GATE 1: Check if actual hostnames resolve via public DNS
+        const resolver = new Resolver();
+        resolver.setServers(["1.1.1.1", "8.8.8.8"]);
         const unresolvedSubs = [];
         for (const h of hostnames) {
             try {
@@ -508,7 +479,7 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 content: [
                     {
                         type: "text",
-                        text: `REFUSED: ${unresolvedSubs.join(", ")} do not resolve (checked via Google DNS). The tunnel URLs will not work.\n\nThis usually means the CNAME records have not been created. Run tunnel-create first — it creates the CNAME records in Cloudflare.\n\nIf tunnel-create has already been run, this may be DNS propagation (wait a few minutes) or the domain may not be Active on Cloudflare. Run cf-zone-status to check.\n\nDo not call tunnel-enable until the hostnames resolve.`,
+                        text: `REFUSED: ${unresolvedSubs.join(", ")} do not resolve via public DNS. The tunnel's URLs will not work.\n\nUsually this means the DNS records were never created or are still propagating. Run tunnel-create first. If that has already run, wait 1-5 minutes for propagation or ask the user to confirm in the Cloudflare dashboard that the addresses exist on the correct domain.\n\nDo not call tunnel-enable until the addresses resolve.`,
                     },
                 ],
                 isError: true,
@@ -517,7 +488,7 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
         const brand = cloudflared.loadBrand();
         const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
         console.error(`[tunnel-enable] using PLATFORM_PORT=${platformPort}`);
-        // GATE 2: Remote auth must be configured (verified via live API, not file check)
+        // GATE 2: Remote auth must be configured
         try {
             const res = await fetch(`http://127.0.0.1:${platformPort}/api/remote-auth/status`, {
                 signal: AbortSignal.timeout(5000),
@@ -546,23 +517,20 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 isError: true,
             };
         }
-        // GATE 3: auth pre-conditions — cert + binding + accountId match.
-        // We use validateAuth (non-throwing) so we can produce a uniform
-        // refusal message regardless of which condition failed.
+        // GATE 3: cert.pem + binding
         const enableAuth = cloudflared.validateAuth();
         if (!enableAuth.bound) {
-            const missing = !enableAuth.hasCert ? "cert.pem" : !enableAuth.hasBinding ? "account binding" : "matching cert/binding";
             return {
                 content: [
                     {
                         type: "text",
-                        text: `REFUSED: Cannot start tunnel — ${missing} is missing or mismatched. ${cloudflared.recoveryMessage()}`,
+                        text: `REFUSED: Cannot start tunnel — this laptop is not signed into Cloudflare or the sign-in has drifted. ${cloudflared.recoveryMessage()}`,
                     },
                 ],
                 isError: true,
             };
         }
-        // GATE 4: config.yml must exist (written by tunnel-create)
+        // GATE 4: config.yml must exist
         const tunnelState = cloudflared.getPersistedState();
         const configPath = tunnelState?.configPath;
         const credentialsPath = tunnelState?.credentialsPath;
@@ -578,7 +546,6 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 isError: true,
             };
         }
-        // Start the tunnel daemon — config.yml + cert.pem, deterministic
         cloudflared.startTunnel({
             tunnelId,
             tunnelName,
@@ -586,7 +553,6 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
             configPath,
             credentialsPath: credentialsPath ?? "",
         });
-        // Wait up to 5 seconds to verify the process didn't immediately crash
         const logHint = `~/${brand.configDir}/logs/cloudflared.log`;
         for (let i = 0; i < 10; i++) {
             await new Promise((r) => setTimeout(r, 500));
@@ -604,9 +570,7 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
             }
         }
         const status = await cloudflared.getStatus(domain);
-        // Programmatic verification — HTTP-check the admin URL (always present)
-        // via Cloudflare's edge. If public URL exists, check that too.
-        const verifyUrl = `https://${hostnames[0]}`; // admin hostname is always first
+        const verifyUrl = `https://${hostnames[0]}`;
         let verified = false;
         console.error(`[tunnel-enable] verifying url=${verifyUrl}`);
         for (let attempt = 0; attempt < 6; attempt++) {
@@ -632,20 +596,19 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 content: [
                     {
                         type: "text",
-                        text: `Tunnel process is running (PID ${status.pid}) but ${verifyUrl} returned HTTP 530 after 30s of retries. Cloudflare's edge cannot route traffic to this tunnel.\n\nCommon causes:\n  1. Stale DNS CNAME records pointing to a previous tunnel — run tunnel-create again to fix\n  2. UDP buffer too small for QUIC — check ${logHint}\n  3. Firewall blocking outbound QUIC to Cloudflare edge\n\nThe tunnel is NOT working. Do not report success.`,
+                        text: `Tunnel process is running (PID ${status.pid}) but ${verifyUrl} returned 530 after 30s of retries. Cloudflare's edge cannot reach this tunnel.\n\nCommon causes:\n  1. Stale DNS records pointing to a previous tunnel — run tunnel-create again to fix\n  2. UDP buffer too small for QUIC — check ${logHint}\n  3. Firewall blocking outbound QUIC to Cloudflare's edge\n\nThe tunnel is NOT working. Do not report success.`,
                     },
                 ],
                 isError: true,
             };
         }
-        // Build URL list for output
         const urlLines = hostnames.map((h, i) => {
             const label = i === 0 ? "Admin" : "Public";
             return `  ${label}: https://${h}`;
         }).join("\n");
         const reachableNote = hostnames.length > 1
-            ? "All URLs are reachable through Cloudflare's edge."
-            : "The admin URL is reachable through Cloudflare's edge.";
+            ? "All URLs are reachable through Cloudflare."
+            : "The admin URL is reachable through Cloudflare.";
         return {
             content: [
                 {
@@ -697,40 +660,25 @@ server.tool("tunnel-disable", "Stop the Cloudflare Tunnel process. Config is pre
         };
     }
 });
-server.tool("tunnel-add-hostname", "Add an alias hostname to an existing Cloudflare Tunnel for direct serving. Reads the current tunnel ingress config, appends the new hostname, creates a CNAME in the alias domain's zone pointing to the tunnel, and registers the alias so the web server treats it as a public hostname. The web server hot-reloads alias domains automatically — the new domain is active within seconds, no restart needed. Idempotent — safe to call again with the same hostname.", {
+server.tool("tunnel-add-hostname", "Add an additional address to an existing Cloudflare Tunnel. Refuses pre-flight when the hostname's domain is not on Cloudflare, and refuses post-flight when `cloudflared` routes the address under a different domain (meaning the laptop is signed into the wrong Cloudflare account). Idempotent — safe to call again with the same hostname.", {
     hostname: z
         .string()
-        .describe("The alias domain to add (e.g. 'maxy.chat'). Must be an Active zone on the Cloudflare account."),
+        .describe("The address to add (e.g. 'maxy.chat'). The domain must be on the Cloudflare account this laptop is signed into."),
     tunnelId: z
         .string()
         .describe("The tunnel UUID. Get this from tunnel-status."),
 }, async ({ hostname, tunnelId }) => {
     try {
-        // getZoneId enforces auth pre-conditions and refuses if the alias
-        // domain isn't a zone on the bound account.
-        const zoneId = await cloudflared.getZoneId(hostname);
-        // Step 2: Add hostname to tunnel ingress (read-then-append)
-        const ingress = await cloudflared.addHostnameToIngress(tunnelId, hostname);
-        // Step 3: Create CNAME via SDK. The cert-bound credential carries
-        // Zone:DNS:Edit for zones owned by the bound account. On any error,
-        // surface as failure — no fallback path remains.
-        const dns = await cloudflared.createDnsRecord(zoneId, hostname, tunnelId);
-        // Step 4: Persist alias domain for web server recognition
+        const route = await cloudflared.routeDnsCli(tunnelId, hostname);
         cloudflared.saveAliasDomain(hostname);
-        // Build response
-        const ingressNote = ingress.alreadyPresent
-            ? "already in tunnel ingress"
-            : "added to tunnel ingress";
-        const dnsNote = dns.updated
-            ? "updated — was pointing to wrong tunnel"
-            : dns.existing
-                ? "already existed"
-                : "created";
+        const routeNote = route.created
+            ? "created"
+            : "already existed";
         return {
             content: [
                 {
                     type: "text",
-                    text: `Alias domain configured for direct serving.\n\n  Hostname: ${hostname}\n  Tunnel ingress: ${ingressNote}\n  DNS CNAME: ${dnsNote} (→ ${tunnelId}.cfargotunnel.com)\n  Web server: registered in alias-domains.json (hot-reloaded automatically)\n\nhttps://${hostname} is now active — the web server picks up the new alias domain within seconds. It serves the public chat directly — no redirect, URL stays as ${hostname}. Verify the URL to confirm.`,
+                    text: `Address configured.\n\n  Address: ${hostname}\n  Routing: ${routeNote}\n  Web server: registered in alias-domains.json (hot-reloaded automatically)\n\nhttps://${hostname} will be active once DNS propagates (1-5 minutes). Run tunnel-status to confirm.`,
                 },
             ],
         };
@@ -746,7 +694,7 @@ server.tool("tunnel-add-hostname", "Add an alias hostname to an existing Cloudfl
             content: [
                 {
                     type: "text",
-                    text: `Failed to add alias hostname: ${err instanceof Error ? err.message : String(err)}`,
+                    text: `Failed to add address: ${err instanceof Error ? err.message : String(err)}`,
                 },
             ],
             isError: true,
@@ -764,12 +712,11 @@ server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslo
     nameserver: z
         .string()
         .optional()
-        .describe("Custom nameserver IP (default: Google 8.8.8.8 + Cloudflare 1.1.1.1)"),
+        .describe("Custom nameserver IP (default: Cloudflare 1.1.1.1 + Google 8.8.8.8)"),
 }, async ({ hostname, type, nameserver }) => {
     try {
-        const dns = await import("node:dns/promises");
-        const resolver = new dns.Resolver();
-        resolver.setServers(nameserver ? [nameserver] : ["8.8.8.8", "1.1.1.1"]);
+        const resolver = new Resolver();
+        resolver.setServers(nameserver ? [nameserver] : ["1.1.1.1", "8.8.8.8"]);
         const recordType = type ?? "A";
         const results = {
             hostname,
@@ -791,15 +738,13 @@ server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslo
                 catch (cnameErr) {
                     const cnameCode = cnameErr.code;
                     if (cnameCode === "ENODATA") {
-                        // Cloudflare-proxied CNAMEs are flattened to A records — resolveCname
-                        // returns ENODATA even though the hostname resolves. Fall back to A.
                         try {
                             const aRecords = await resolver.resolve4(hostname);
-                            results.note = "CNAME lookup returned ENODATA — record is likely Cloudflare-proxied (flattened to A)";
+                            results.note = "CNAME lookup returned ENODATA — record is likely flattened to A";
                             results.addresses = aRecords;
                         }
                         catch {
-                            throw cnameErr; // A also failed — rethrow original ENODATA
+                            throw cnameErr;
                         }
                     }
                     else {
@@ -845,809 +790,12 @@ server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslo
         };
     }
 });
-// ===================================================================
-// cf-verify / cf-rebuild — account-state report + nuclear cleanup
-// ===================================================================
-server.tool("cf-verify", "Read the bound Cloudflare account and the device's local state, return a JSON snapshot. Account section: zones, tunnels, CNAMEs (grouped by zone). Device section: cert.pem, account-binding.json, tunnel.state, config.yml, alias-domains.json. Orphans section: account artefacts not referenced by the device's current intended state (tunnels, CNAMEs, zones not used by any intended hostname). Non-mutating. Runs in any state including fresh-install-before-login.", {}, async () => {
-    try {
-        const report = await cloudflared.cfVerifyCore();
-        return {
-            content: [{ type: "text", text: JSON.stringify(report, null, 2) }],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `cf-verify failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("cf-rebuild", "Nuclear cleanup of the bound Cloudflare account. Deletes every tunnel, CNAME, and (where the account permits) zone NOT in the `preserve` set. With no preserve args, infers what to keep from the device's `tunnel.state` and `alias-domains.json`. Pass `preserve.zones`, `preserve.tunnelIds`, or `preserve.cnames` to override. `dryRun=true` plans without mutating. The agent owns the bound account absolutely — anything not in preserve is treated as junk.", {
-    dryRun: z
-        .boolean()
-        .optional()
-        .describe("If true, report what cf-rebuild WOULD delete without performing any mutations."),
-    preserve: z
-        .object({
-        zones: z.array(z.string()).optional().describe("Zone names to keep (whole zones; all CNAMEs under them survive unless preserve.cnames overrides)."),
-        tunnelIds: z.array(z.string()).optional().describe("Tunnel UUIDs to keep."),
-        cnames: z.array(z.object({ zone: z.string(), name: z.string() })).optional().describe("Per-CNAME preserve list. When set, ONLY these CNAMEs survive within preserved zones."),
-    })
-        .optional()
-        .describe("Preservation set. Anything on the account not listed here is deleted. Defaults to whatever the device's tunnel.state and alias-domains.json reference."),
-}, async ({ dryRun, preserve }) => {
-    try {
-        const report = await cloudflared.cfRebuildCore({ dryRun: dryRun ?? false, preserve });
-        return {
-            content: [{ type: "text", text: JSON.stringify(report, null, 2) }],
-            isError: report.halted,
-        };
-    }
-    catch (err) {
-        if (err instanceof cloudflared.CloudflareRefusalError) {
-            return {
-                content: [{ type: "text", text: err.refusal.message }],
-                isError: true,
-            };
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `cf-rebuild failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-const LABEL_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
-function sanitizedDomain(domain) {
-    return domain.replace(/\./g, "-");
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
 }
-function deriveTunnelName(adminLabel, domain) {
-    return `${adminLabel}-${sanitizedDomain(domain)}`;
-}
-function hasBrandCredsFor(tunnelId) {
-    const path = join(homedir(), cloudflared.loadBrand().configDir, "cloudflared", `${tunnelId}.json`);
-    return existsSync(path);
-}
-server.tool("cloudflare-setup", "Deterministic, UI-driven state machine for Cloudflare Tunnel setup. Call with no parameters to begin; the tool evaluates current state and returns a structured result describing what to render next. When a returned status begins with 'awaiting_', read `data.render` and call render-component with its contents verbatim — do not paraphrase, do not prompt the user for values. When the user submits a component (single-select, tunnel-route-picker), the agent's sole job is to relay the submission's fields (selectedTunnelId, selectedZoneName, adminLabel, publicLabel) back into this tool unchanged. The agent never synthesises subdomains or domain fragments from free text.", {
-    selectedTunnelId: z
-        .string()
-        .optional()
-        .describe("Tunnel ID from the single-select submission. The literal string '__new__' means the user chose to create a new tunnel. Pass only when the last component rendered was the tunnel selection list."),
-    selectedZoneName: z
-        .string()
-        .optional()
-        .describe("Zone name from the single-select submission. Pass only when the last component rendered was the zone selection list."),
-    adminLabel: z
-        .string()
-        .optional()
-        .describe("Admin DNS label from the tunnel-route-picker submission. DNS-label-safe (a-z, 0-9, hyphen, no leading/trailing hyphen). Pass only when the last component rendered was tunnel-route-picker."),
-    publicLabel: z
-        .string()
-        .optional()
-        .describe("Public DNS label from the tunnel-route-picker submission. Optional; omit to skip the public endpoint. DNS-label-safe. Pass only when the last component rendered was tunnel-route-picker."),
-    cleanupConfirmed: z
-        .boolean()
-        .optional()
-        .describe("Operator confirmation to delete pollution on the bound Cloudflare account (zones, tunnels, and CNAMEs not matching the chosen domain). Pass only when the last component rendered was the cleanup confirmation — comes from the component's submitMessage verbatim. Never synthesise from free text."),
-}, async ({ selectedTunnelId, selectedZoneName, adminLabel, publicLabel, cleanupConfirmed }) => {
-    const log = (msg) => console.error(`[cloudflare-setup] ${msg}`);
-    try {
-        // ── Step 1: cloudflared binary ──────────────────────────────────
-        log("checking cloudflared installation");
-        if (!cloudflared.isInstalled()) {
-            log("cloudflared not installed — installing");
-            const { execFileSync } = await import("node:child_process");
-            const arch = process.arch === "arm64" ? "arm64" : "amd64";
-            const debUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${arch}.deb`;
-            try {
-                execFileSync("curl", ["-fsSL", debUrl, "-o", "/tmp/cloudflared.deb"], { timeout: 60000 });
-                execFileSync("sudo", ["dpkg", "-i", "/tmp/cloudflared.deb"], { timeout: 30000 });
-                execFileSync("rm", ["-f", "/tmp/cloudflared.deb"]);
-                log("cloudflared installed successfully");
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`installation failed: ${msg}`);
-                return result({ status: "error", message: `Could not install cloudflared: ${msg}` });
-            }
-        }
-        // ── Step 2: Authentication ──────────────────────────────────────
-        log("checking authentication");
-        const auth = cloudflared.validateAuth();
-        if (auth.bound) {
-            log(`authenticated — cert and binding agree on account ${auth.boundAccountId}`);
-        }
-        else if (auth.hasCert) {
-            // cert.pem exists — materialize binding (migration path) or surface
-            // drift if the binding disagrees with the cert.
-            const creds = cloudflared.parseCertPem();
-            if (!creds) {
-                log("cert.pem exists but could not extract credentials");
-                return result({
-                    status: "error",
-                    message: "Found a Cloudflare certificate but could not extract credentials from it. Sign in again — I'll clear the old certificate and start fresh.",
-                });
-            }
-            if (!auth.hasBinding) {
-                const binding = cloudflared.materializeBinding("migration");
-                log(`materialized binding from existing cert — account ${binding.accountId}`);
-            }
-            else if (auth.certAccountId !== auth.boundAccountId) {
-                log(`account drift: cert=${auth.certAccountId} binding=${auth.boundAccountId}`);
-                return result({
-                    status: "error",
-                    message: `Your Cloudflare certificate is bound to a different account than this device's recorded binding. ${cloudflared.recoveryMessage()}`,
-                });
-            }
-        }
-        else {
-            // No cert, no token — need login
-            log("no authentication found — starting login");
-            // Get auth URL from existing login process or spawn a fresh one
-            let authUrl;
-            const activeLogin = cloudflared.getActiveLogin();
-            if (activeLogin) {
-                log(`login process already running (PID ${activeLogin.pid})`);
-                authUrl = activeLogin.authUrl;
-            }
-            else {
-                try {
-                    const loginResult = await cloudflared.tunnelLogin();
-                    log(`login spawned — auth URL: ${loginResult.authUrl}`);
-                    authUrl = loginResult.authUrl;
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    log(`login failed: ${msg}`);
-                    return result({
-                        status: "error",
-                        message: `Could not start Cloudflare sign-in: ${msg}`,
-                    });
-                }
-            }
-            // Return immediately — the agent shows the URL, user authorizes,
-            // then re-calls cloudflare-setup. hasCert() at line 1082 handles re-entry.
-            log(`returning awaiting_auth — auth URL: ${authUrl}`);
-            return result({
-                status: "awaiting_auth",
-                message: "Open the authorization URL in your browser and click Authorize. Once done, let me know and I'll continue the setup.",
-                data: { authUrl },
-            });
-        }
-        // ── Step 3: Discover state — tunnel, zone, domain ───────────────
-        const existingState = cloudflared.getPersistedState();
-        const platformPort = parseInt(process.env.PLATFORM_PORT ?? "19200", 10);
-        // If state already has a tunnel identity with hostnames, labels are
-        // reconstructed from the persisted hostnames on every re-entry where
-        // the agent doesn't supply fresh labels. This is how the flow
-        // survives the awaiting_password round-trip.
-        const stateAdminLabel = existingState?.adminHostname && existingState.domain
-            ? existingState.adminHostname.replace(`.${existingState.domain}`, "")
-            : null;
-        const statePublicLabel = existingState?.publicHostname && existingState?.domain
-            ? existingState.publicHostname.replace(`.${existingState.domain}`, "")
-            : null;
-        let allTunnels = [];
-        let allZones = [];
-        try {
-            [allTunnels, allZones] = await Promise.all([
-                cloudflared.listTunnelsOnAccount(),
-                cloudflared.listZones(),
-            ]);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            log(`discovery failed: ${msg}`);
-            return result({
-                status: "error",
-                message: `Could not read your Cloudflare account: ${msg}`,
-            });
-        }
-        log(`entry tunnelsOnAccount=${allTunnels.length} zonesOnAccount=${allZones.length}`);
-        const activeZones = allZones.filter((z) => z.status === "active");
-        const pendingZones = allZones.filter((z) => z.status === "pending");
-        // Resolve domain — precedence: persisted state > tunnel selection > zone selection > auto-only-active
-        let domain = existingState?.domain ?? null;
-        if (!domain && selectedTunnelId && selectedTunnelId !== "__new__") {
-            const tunnel = allTunnels.find((t) => t.id === selectedTunnelId);
-            if (!tunnel) {
-                log(`selectedTunnelId ${selectedTunnelId} not found on account`);
-                return result({
-                    status: "error",
-                    message: "That tunnel is no longer on your account. Let me check again.",
-                });
-            }
-            const zoneName = await cloudflared.findZoneHostingTunnel(selectedTunnelId);
-            if (!zoneName) {
-                log(`selected tunnel ${selectedTunnelId} has no zone hosting it — falling back to zone selection`);
-                // Fall through to zone-selection branch below
-            }
-            else {
-                domain = zoneName;
-                log(`branch=existing-tunnel tunnelId=${selectedTunnelId} domain=${domain}`);
-            }
-        }
-        if (!domain && selectedZoneName) {
-            const zone = activeZones.find((z) => z.name === selectedZoneName);
-            if (!zone) {
-                log(`selectedZoneName ${selectedZoneName} not active on account`);
-                return result({
-                    status: "error",
-                    message: "That domain is no longer Active on your account. Let me check again.",
-                });
-            }
-            domain = selectedZoneName;
-        }
-        // No prior state, no selection — prompt the user for a tunnel
-        // (if account has any) or a zone (if account has >1 active zone).
-        if (!domain) {
-            if (allTunnels.length > 0 && !selectedTunnelId) {
-                log(`awaiting_tunnel_selection tunnelsOnAccount=${allTunnels.length}`);
-                const options = [
-                    { value: "__new__", label: "Create a new tunnel (recommended)" },
-                    ...allTunnels.map((t) => ({ value: t.id, label: t.name })),
-                ];
-                return result({
-                    status: "awaiting_tunnel_selection",
-                    message: "Pick a tunnel for this device. For a fresh setup, choose Create a new tunnel.",
-                    data: {
-                        tunnels: allTunnels.map((t) => ({ id: t.id, name: t.name })),
-                        render: {
-                            name: "single-select",
-                            data: {
-                                title: "Tunnel",
-                                description: "Each device uses its own tunnel. Creating a new one is the normal choice.",
-                                options,
-                                submitLabel: "Use this tunnel",
-                                submitMessage: '{"selectedTunnelId":"{{value}}"}',
-                            },
-                        },
-                    },
-                });
-            }
-            // From here: selectedTunnelId is "__new__" or undefined (no tunnels on account).
-            if (activeZones.length === 0) {
-                if (pendingZones.length > 0) {
-                    const z = pendingZones[0];
-                    log(`awaiting_nameservers zone=${z.name}`);
-                    return result({
-                        status: "awaiting_nameservers",
-                        message: `Your domain ${z.name} is on Cloudflare but not yet active. Update the nameservers at your registrar to:\n\n• ${z.nameservers[0]}\n• ${z.nameservers[1]}\n\nLet me know when you've updated them.`,
-                        data: { nameservers: z.nameservers },
-                    });
-                }
-                log(`branch=zone-add-fallback reason=noZones`);
-                return result({
-                    status: "awaiting_zone_add_dashboard",
-                    message: "No domain on your Cloudflare account yet. Sign in at cloudflare.com, click Add a site, and add your domain. When it appears on the account, let me know and I'll continue.",
-                    data: { dashboardUrl: "https://dash.cloudflare.com" },
-                });
-            }
-            if (activeZones.length > 1) {
-                log(`awaiting_zone_selection activeZones=${activeZones.length}`);
-                return result({
-                    status: "awaiting_zone_selection",
-                    message: "Multiple domains on your Cloudflare account. Pick the one to use for this device.",
-                    data: {
-                        zones: activeZones.map((z) => ({ name: z.name, status: z.status })),
-                        render: {
-                            name: "single-select",
-                            data: {
-                                title: "Domain",
-                                options: activeZones.map((z) => ({ value: z.name, label: z.name })),
-                                submitLabel: "Use this domain",
-                                submitMessage: '{"selectedZoneName":"{{value}}"}',
-                            },
-                        },
-                    },
-                });
-            }
-            // Exactly one active zone — use it.
-            domain = activeZones[0].name;
-            log(`auto-selected only active zone: ${domain}`);
-        }
-        // Verify the resolved zone is active (guard against state with a since-pending zone)
-        const zone = allZones.find((z) => z.name === domain);
-        if (zone && zone.status === "pending") {
-            log(`zone ${domain} is pending — returning awaiting_nameservers`);
-            return result({
-                status: "awaiting_nameservers",
-                message: `Your domain ${domain} is not yet active on Cloudflare. Update the nameservers at your registrar to:\n\n• ${zone.nameservers[0]}\n• ${zone.nameservers[1]}\n\nLet me know when you've updated them.`,
-                data: { nameservers: zone.nameservers },
-            });
-        }
-        // ── Step 3b: Cleanup — bound account is the universe ────────────
-        // The chosen zone + any currently-persisted tunnel are intent;
-        // everything else on the account is pollution. Surface it, require
-        // explicit operator confirmation, then delete before creating the
-        // new tunnel (so the label-collision check runs against a clean
-        // zone, not one littered with stale `<deadTunnel>.cfargotunnel.com`
-        // pointers).
-        const preservedTunnelIds = new Set();
-        if (existingState?.tunnelId)
-            preservedTunnelIds.add(existingState.tunnelId);
-        if (selectedTunnelId && selectedTunnelId !== "__new__") {
-            preservedTunnelIds.add(selectedTunnelId);
-        }
-        const domainLc = domain.toLowerCase();
-        const pollutionZonesList = allZones.filter((z) => z.status === "active" && z.name.toLowerCase() !== domainLc);
-        const pollutionTunnelsList = allTunnels.filter((t) => !preservedTunnelIds.has(t.id));
-        // Only surface CNAMEs on the PRESERVED zone that point to deleted
-        // tunnels — those need explicit disclosure because the zone itself
-        // survives. CNAMEs under pollution zones are cascade-deleted when
-        // the zone is deleted; listing them separately would duplicate
-        // the same destruction in the confirm UI.
-        let pollutionCnamesList = [];
-        if (pollutionTunnelsList.length > 0) {
-            try {
-                const verify = await cloudflared.cfVerifyCore();
-                if (verify.account) {
-                    const pollutionTunnelIdSet = new Set(pollutionTunnelsList.map((t) => t.id));
-                    pollutionCnamesList = verify.account.cnames
-                        .filter((c) => {
-                        if (c.zone.toLowerCase() !== domainLc)
-                            return false;
-                        const m = c.content.toLowerCase().trim().match(/^([0-9a-f-]{36})\.cfargotunnel\.com\.?$/);
-                        return Boolean(m && pollutionTunnelIdSet.has(m[1]));
-                    })
-                        .map((c) => ({ zone: c.zone, name: c.name, content: c.content }));
-                }
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`cfVerifyCore during cleanup check failed: ${msg}`);
-                // Continue with zone/tunnel pollution only — conservative.
-            }
-        }
-        const pollutionTotal = pollutionZonesList.length +
-            pollutionTunnelsList.length +
-            pollutionCnamesList.length;
-        if (pollutionTotal > 0) {
-            if (!cleanupConfirmed) {
-                log(`awaiting_cleanup_confirmation pollutionZones=${pollutionZonesList.length} pollutionTunnels=${pollutionTunnelsList.length} pollutionCnames=${pollutionCnamesList.length}`);
-                const items = [
-                    ...pollutionZonesList.map((z) => ({ label: "Domain (zone)", value: z.name })),
-                    ...pollutionTunnelsList.map((t) => ({ label: "Tunnel", value: t.name })),
-                    ...pollutionCnamesList.map((c) => ({
-                        label: "DNS record",
-                        value: `${c.name} → ${c.content}`,
-                    })),
-                ];
-                const confirmPayload = {
-                    cleanupConfirmed: true,
-                    selectedZoneName: domain,
-                };
-                if (selectedTunnelId)
-                    confirmPayload.selectedTunnelId = selectedTunnelId;
-                return result({
-                    status: "awaiting_cleanup_confirmation",
-                    message: `Your Cloudflare account has artefacts from prior work that don't belong to the ${domain} setup. Confirm to clean them up before creating the tunnel.`,
-                    data: {
-                        domain,
-                        pollution: {
-                            zones: pollutionZonesList.map((z) => ({ name: z.name })),
-                            tunnels: pollutionTunnelsList.map((t) => ({ id: t.id, name: t.name })),
-                            cnames: pollutionCnamesList,
-                        },
-                        render: {
-                            name: "confirm",
-                            data: {
-                                title: `Clean up before setting up ${domain}?`,
-                                description: `Keeping ${domain}. Everything below will be deleted.`,
-                                items,
-                                confirmLabel: "Clean up and continue",
-                                rejectLabel: "Cancel",
-                                confirmMessage: JSON.stringify(confirmPayload),
-                                rejectMessage: "I don't want to clean up.",
-                            },
-                        },
-                    },
-                });
-            }
-            // Cleanup confirmed — run the rebuild with explicit intent.
-            log(`cleanup confirmed — cfRebuildCore preserve.zones=[${domain}] preserve.tunnelIds=[${[...preservedTunnelIds].join(",")}]`);
-            try {
-                const rebuild = await cloudflared.cfRebuildCore({
-                    preserve: {
-                        zones: [domain],
-                        tunnelIds: [...preservedTunnelIds],
-                    },
-                });
-                if (rebuild.halted) {
-                    return result({
-                        status: "error",
-                        message: `Cleanup halted: ${rebuild.haltReason ?? "unknown reason"}. ${cloudflared.recoveryMessage()}`,
-                    });
-                }
-                const failedActions = rebuild.actions.filter((a) => a.result === "failed");
-                if (failedActions.length > 0) {
-                    return result({
-                        status: "error",
-                        message: `Cleanup completed with ${failedActions.length} failed action(s) of ${rebuild.actions.length}. First: ${failedActions[0].detail ?? "(no detail)"}. Run cf-verify to see current state.`,
-                    });
-                }
-                log(`cleanup complete actions=${rebuild.actions.length}`);
-                // Refresh tunnels snapshot so label collision checks run against
-                // the post-cleanup account state.
-                try {
-                    allTunnels = await cloudflared.listTunnelsOnAccount();
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    log(`post-cleanup tunnel refresh failed: ${msg}`);
-                }
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`cleanup failed: ${msg}`);
-                return result({
-                    status: "error",
-                    message: `Could not clean up your Cloudflare account: ${msg}`,
-                });
-            }
-        }
-        // ── Step 4: Labels ──────────────────────────────────────────────
-        // Resolution precedence: args > persisted state hostnames.
-        const resolvedAdminLabel = adminLabel ?? stateAdminLabel;
-        const resolvedPublicLabel = publicLabel ?? statePublicLabel ?? null;
-        if (!resolvedAdminLabel) {
-            log(`ui=tunnel-route-picker rendered tunnelDomain=${domain}`);
-            return result({
-                status: "awaiting_labels",
-                message: `Pick a short name for your admin address on ${domain}. You can also pick one for a public address, or leave it empty.`,
-                data: {
-                    domain,
-                    render: {
-                        name: "tunnel-route-picker",
-                        data: {
-                            domain,
-                            title: "Pick your addresses",
-                            description: "Your admin address is required. Public is optional and can be added later.",
-                            submitLabel: "Set up addresses",
-                        },
-                    },
-                },
-            });
-        }
-        // Defense-in-depth label validation (UI already filters, but tool
-        // is authoritative — an agent misroute must fail loudly, not silently).
-        if (!LABEL_RE.test(resolvedAdminLabel)) {
-            log(`invalid admin label: ${resolvedAdminLabel}`);
-            return result({
-                status: "label-taken",
-                message: "Admin label is not a valid DNS label. Pick something that is lowercase letters, numbers, and hyphens.",
-                data: {
-                    domain,
-                    field: "admin",
-                    render: {
-                        name: "tunnel-route-picker",
-                        data: {
-                            domain,
-                            title: "Pick your addresses",
-                            defaultAdmin: "",
-                            defaultPublic: resolvedPublicLabel ?? "",
-                            error: { field: "admin", message: "Not a valid address — use lowercase letters, numbers, and hyphens." },
-                            submitLabel: "Set up addresses",
-                        },
-                    },
-                },
-            });
-        }
-        if (resolvedPublicLabel !== null && resolvedPublicLabel !== "" && !LABEL_RE.test(resolvedPublicLabel)) {
-            log(`invalid public label: ${resolvedPublicLabel}`);
-            return result({
-                status: "label-taken",
-                message: "Public label is not a valid DNS label.",
-                data: {
-                    domain,
-                    field: "public",
-                    render: {
-                        name: "tunnel-route-picker",
-                        data: {
-                            domain,
-                            defaultAdmin: resolvedAdminLabel,
-                            defaultPublic: "",
-                            error: { field: "public", message: "Not a valid address." },
-                            submitLabel: "Set up addresses",
-                        },
-                    },
-                },
-            });
-        }
-        if (resolvedPublicLabel && resolvedAdminLabel === resolvedPublicLabel) {
-            log(`admin and public labels identical: ${resolvedAdminLabel}`);
-            return result({
-                status: "label-taken",
-                message: "Admin and public addresses must differ.",
-                data: {
-                    domain,
-                    field: "public",
-                    render: {
-                        name: "tunnel-route-picker",
-                        data: {
-                            domain,
-                            defaultAdmin: resolvedAdminLabel,
-                            defaultPublic: "",
-                            error: { field: "public", message: "Public must differ from admin." },
-                            submitLabel: "Set up addresses",
-                        },
-                    },
-                },
-            });
-        }
-        const adminHostname = `${resolvedAdminLabel}.${domain}`;
-        const publicHostname = resolvedPublicLabel ? `${resolvedPublicLabel}.${domain}` : null;
-        const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
-        // Account-zone scope check happens inside routeDnsCli (Step 6) — the
-        // domain was picked from the live account zone list, so by construction
-        // it is on the bound account. No pre-flight needed here.
-        // ── Step 5: Resolve or create tunnel (idempotent on re-entry) ───
-        let tunnelId = existingState?.tunnelId ?? null;
-        let tunnelName = existingState?.tunnelName ?? null;
-        let credentialsPath = existingState?.credentialsPath ?? null;
-        if (!tunnelId) {
-            if (selectedTunnelId && selectedTunnelId !== "__new__") {
-                // User picked an existing tunnel — reuse its identity.
-                const selected = allTunnels.find((t) => t.id === selectedTunnelId);
-                if (!selected) {
-                    return result({
-                        status: "error",
-                        message: "Selected tunnel not found on account.",
-                    });
-                }
-                if (!hasBrandCredsFor(selected.id)) {
-                    // Cannot reuse without credentials — this tunnel belongs to
-                    // another device on the same account. Surface structured error.
-                    log(`collision type=tunnel-name label=${resolvedAdminLabel} existingTunnelId=${selected.id}`);
-                    return result({
-                        status: "tunnel-name-taken",
-                        message: `The tunnel "${selected.name}" belongs to another device. Pick a different label for this one.`,
-                        data: {
-                            suggestedLabel: `${resolvedAdminLabel}2`,
-                            existingTunnelId: selected.id,
-                            render: {
-                                name: "tunnel-route-picker",
-                                data: {
-                                    domain,
-                                    defaultAdmin: "",
-                                    defaultPublic: resolvedPublicLabel ?? "",
-                                    error: { field: "admin", message: `That address is already taken. Pick a different one.` },
-                                    submitLabel: "Set up addresses",
-                                },
-                            },
-                        },
-                    });
-                }
-                tunnelId = selected.id;
-                tunnelName = selected.name;
-            }
-            else {
-                // Create new — tunnel name is derived from admin label + domain.
-                const derivedName = deriveTunnelName(resolvedAdminLabel, domain);
-                log(`branch=new-tunnel zoneName=${domain} tunnelName=${derivedName}`);
-                const accountExisting = allTunnels.find((t) => t.name === derivedName);
-                if (accountExisting && !hasBrandCredsFor(accountExisting.id)) {
-                    log(`collision type=tunnel-name label=${resolvedAdminLabel} existingTunnelId=${accountExisting.id}`);
-                    return result({
-                        status: "tunnel-name-taken",
-                        message: `The address ${resolvedAdminLabel}.${domain} is already in use by another device. Pick a different one.`,
-                        data: {
-                            domain,
-                            suggestedLabel: `${resolvedAdminLabel}2`,
-                            existingTunnelId: accountExisting.id,
-                            field: "admin",
-                            render: {
-                                name: "tunnel-route-picker",
-                                data: {
-                                    domain,
-                                    defaultAdmin: "",
-                                    defaultPublic: resolvedPublicLabel ?? "",
-                                    error: { field: "admin", message: `That address is already taken — pick a different one.` },
-                                    submitLabel: "Set up addresses",
-                                },
-                            },
-                        },
-                    });
-                }
-                try {
-                    const created = cloudflared.createTunnelCli(derivedName);
-                    tunnelId = created.tunnelId;
-                    tunnelName = created.tunnelName;
-                    credentialsPath = created.credentialsPath;
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    log(`tunnel creation failed: ${msg}`);
-                    return result({ status: "error", message: `Could not create the tunnel: ${msg}` });
-                }
-            }
-        }
-        if (!tunnelId || !tunnelName) {
-            return result({ status: "error", message: "Tunnel identity could not be resolved." });
-        }
-        // Fallback credentials path when reusing a tunnel picked from the UI:
-        // createTunnelCli already copies from ~/.cloudflared to the brand dir,
-        // but that runs only in the create branch. For the "reuse existing"
-        // branch, derive the same brand-dir path here.
-        if (!credentialsPath) {
-            credentialsPath = join(homedir(), cloudflared.loadBrand().configDir, "cloudflared", `${tunnelId}.json`);
-        }
-        // ── Step 6: DNS routing + config (idempotent every call) ────────
-        for (const h of hostnames) {
-            const check = await cloudflared.checkDnsCollision(h, tunnelId);
-            if (check.collision) {
-                const offendingField = h === adminHostname ? "admin" : "public";
-                log(`collision type=label hostname=${h} existingTunnelId=${check.existingTunnelId}`);
-                return result({
-                    status: "label-taken",
-                    message: `The address ${h} already points to a different tunnel. Pick a different ${offendingField} label.`,
-                    data: {
-                        domain,
-                        field: offendingField,
-                        existingTunnelId: check.existingTunnelId ?? undefined,
-                        render: {
-                            name: "tunnel-route-picker",
-                            data: {
-                                domain,
-                                defaultAdmin: offendingField === "admin" ? "" : resolvedAdminLabel,
-                                defaultPublic: offendingField === "public" ? "" : (resolvedPublicLabel ?? ""),
-                                error: { field: offendingField, message: `That address is already in use by another device.` },
-                                submitLabel: "Set up addresses",
-                            },
-                        },
-                    },
-                });
-            }
-        }
-        const configPath = cloudflared.writeLocalConfig(tunnelId, credentialsPath, hostnames, platformPort);
-        cloudflared.saveTunnelIdentity({
-            tunnelId,
-            tunnelName,
-            domain,
-            configPath,
-            credentialsPath,
-            adminHostname,
-            publicHostname,
-        });
-        for (const h of hostnames) {
-            await cloudflared.routeDnsCli(tunnelId, h);
-        }
-        log(`ui=tunnel-route-picker submitted adminLabel=${resolvedAdminLabel} publicLabel=${resolvedPublicLabel ?? "null"}`);
-        // ── Step 7: Remote auth check ───────────────────────────────────
-        // scrypt hashing on Pi ARM takes 2-5s after form submission —
-        // wait before checking to avoid a false negative on every first attempt
-        log("waiting 3s for scrypt hash before checking remote auth");
-        await new Promise((r) => setTimeout(r, 3000));
-        log("checking remote auth");
-        try {
-            const res = await fetch(`http://127.0.0.1:${platformPort}/api/remote-auth/status`, {
-                signal: AbortSignal.timeout(5000),
-            });
-            const body = (await res.json());
-            if (!body.configured) {
-                const setupUrl = `http://${hostname()}.local:${platformPort}/__remote-auth/setup`;
-                log("remote auth not configured");
-                return result({
-                    status: "awaiting_password",
-                    message: `Before enabling remote access, you need to set a password that protects your admin interface over the internet.\n\nOpen this URL in your own browser (not the one in the chat) and set a password:\n\`${setupUrl}\`\n\nChoose something strong — at least 8 characters with a number and a special character. Let me know when you've submitted it.`,
-                    data: { setupUrl },
-                });
-            }
-            log("remote auth configured");
-        }
-        catch {
-            log("remote auth check failed — platform may not be running");
-            return result({
-                status: "error",
-                message: "Could not verify remote access password — the platform may not be running. Make sure it's started and try again.",
-            });
-        }
-        // ── Step 8: Tunnel enable ───────────────────────────────────────
-        const tunnelState = cloudflared.getPersistedState();
-        if (!tunnelState) {
-            return result({ status: "error", message: "Tunnel state lost — please try again." });
-        }
-        const status = await cloudflared.getStatus(domain);
-        if (!status.running) {
-            log("tunnel not running — starting");
-            try {
-                cloudflared.startTunnel({
-                    tunnelId: tunnelState.tunnelId,
-                    tunnelName: tunnelState.tunnelName,
-                    domain,
-                    configPath: tunnelState.configPath,
-                    credentialsPath: tunnelState.credentialsPath,
-                });
-                // Wait to confirm it didn't crash immediately
-                for (let i = 0; i < 10; i++) {
-                    await new Promise((r) => setTimeout(r, 500));
-                    const check = await cloudflared.getStatus(domain);
-                    if (!check.running) {
-                        const brand = cloudflared.loadBrand();
-                        log("tunnel process exited immediately");
-                        return result({
-                            status: "error",
-                            message: `The tunnel started but exited immediately. Check ~/${brand.configDir}/logs/cloudflared.log for details.`,
-                        });
-                    }
-                }
-                // Verify admin URL is reachable through Cloudflare edge
-                const verifyUrl = `https://${adminHostname}`;
-                let verified = false;
-                let lastStatus = null;
-                for (let attempt = 0; attempt < 6; attempt++) {
-                    if (attempt > 0)
-                        await new Promise((r) => setTimeout(r, 5000));
-                    try {
-                        const res = await fetch(verifyUrl, {
-                            signal: AbortSignal.timeout(10000),
-                            redirect: "manual",
-                        });
-                        lastStatus = res.status;
-                        if (res.status !== 530) {
-                            verified = true;
-                            log(`verified url=${verifyUrl} status=${res.status}`);
-                            break;
-                        }
-                    }
-                    catch {
-                        // retry
-                    }
-                }
-                if (!verified) {
-                    log(`verified url=${verifyUrl} status=${lastStatus ?? "timeout"} result=unreachable`);
-                    return result({
-                        status: "error",
-                        message: `The tunnel is running but the admin URL is not reachable yet. This usually resolves in a few minutes as DNS propagates. Try again shortly.`,
-                    });
-                }
-                log("tunnel started and verified");
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`tunnel start failed: ${msg}`);
-                return result({ status: "error", message: `Could not start the tunnel: ${msg}` });
-            }
-        }
-        else {
-            log(`tunnel already running (PID ${status.pid})`);
-        }
-        // ── Complete ────────────────────────────────────────────────────
-        const adminUrl = `https://${adminHostname}`;
-        const publicUrl = publicHostname ? `https://${publicHostname}` : undefined;
-        log(`complete — admin: ${adminUrl}${publicUrl ? `, public: ${publicUrl}` : ""}`);
-        const urlLines = publicUrl
-            ? `Admin: ${adminUrl}\nPublic: ${publicUrl}`
-            : `Admin: ${adminUrl}`;
-        const reachableNote = publicUrl
-            ? "Both URLs are live and reachable."
-            : "The admin URL is live and reachable.";
-        return result({
-            status: "complete",
-            message: `Remote access is set up and verified.\n\n${urlLines}\n\n${reachableNote} The tunnel auto-starts on device reboot.`,
-            data: { adminUrl, publicUrl },
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        log(`unexpected error: ${msg}`);
-        return result({ status: "error", message: `Setup failed: ${msg}` });
-    }
+main().catch((err) => {
+    console.error(`[cloudflare-mcp] fatal: ${err}`);
+    process.exit(1);
 });
-function result(r) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(r, null, 2) }],
-    };
-}
-const transport = new StdioServerTransport();
-await server.connect(transport);
 //# sourceMappingURL=index.js.map