@spinabot/brigade 1.8.0 → 1.9.0

package/README.md

@@ -23,6 +23,25 @@
   <strong>Codex</strong> CLI, reuse that login (no browser, no re-auth).
 </p>
 
+<p align="center">
+  🩸💥 <strong>NEW in v1.9.0 — <code>brigade bloody benchmark</code></strong> 💥🩸
+</p>
+<p align="center">
+  <em>One command. Your whole crew, <strong>live to the world.</strong></em><br/>
+  It drags your localhost gateway out into daylight — HTTPS at the edge, no account, no setup. It
+  defaults to an anonymous <strong>Cloudflare</strong> quick-tunnel, but the providers are pluggable
+  and <strong>fully open-source</strong>: point it at <code>bore</code>, <code>frp</code>,
+  <code>sish</code>, or your own self-hosted relay — no proprietary cloud required. A private access
+  key is minted and <strong>handled for you</strong>: you never see it, and anyone who stumbles onto
+  the URL just bleeds out on a <code>401</code>. 🩸
+  <br/>
+  Too squeamish for the name? It also answers to the polite <code>brigade expose</code>.
+</p>
+
+<p align="center">
+  <code>brigade bloody&nbsp;benchmark</code> &nbsp;·&nbsp; <code>brigade expose</code> &nbsp;·&nbsp; <code>brigade expose stop</code> &nbsp;🩸
+</p>
+
 <p align="center">
   <a href="https://github.com/spinabot/brigade/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/spinabot/brigade/ci.yml?branch=main&style=for-the-badge&logo=githubactions&logoColor=white&label=CI" alt="CI status"></a>
   <a href="https://www.npmjs.com/package/@spinabot/brigade"><img src="https://img.shields.io/npm/v/@spinabot/brigade?style=for-the-badge&logo=npm&logoColor=white&color=CB3837" alt="npm version"></a>

package/dist/buildstamp.json

@@ -1 +1 @@
-{"builtAt":1782398909347,"head":"4cc0d626b2bd8ffb4a49cd4c06347ba9d5d24f05","version":"1.8.0"}
+{"builtAt":1782413017272,"head":"bbea17148ff119b4f52ebb95b1a92e16cf294c5b","version":"1.9.0"}

package/dist/cli/commands/expose.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `brigade expose` ( = `brigade bloody benchmark` ) — publish the gateway to
+ * the public internet through a secure tunnel.
+ *
+ * The gateway WebSocket is unauthenticated and loopback-only by design, so we
+ * never expose it directly. Instead we stand up a token-checking auth-proxy in
+ * front of it (`core/tunnel/auth-proxy.ts`) and tunnel THAT — the public URL
+ * carries a bearer token that the proxy enforces before any byte reaches the
+ * gateway. The gateway's localhost guard is untouched.
+ *
+ *   brigade expose                 — start a cloudflare quick tunnel (token auto-gen)
+ *   brigade expose --provider bore — self-hostable OSS tunnel
+ *   brigade expose --insecure      — NO token gate (loud warning; explicit opt-in)
+ *   brigade expose status          — show the active tunnel
+ *   brigade expose stop            — tear down the active tunnel
+ *
+ * This is a foreground, long-lived command: it holds the tunnel open until
+ * Ctrl-C (or `brigade expose stop` from another terminal).
+ */
+export interface ExposeCommandOptions {
+    provider?: string;
+    token?: string;
+    insecure?: boolean;
+    /** `--open` — synonym for `--insecure` (no token gate). */
+    open?: boolean;
+    relay?: string;
+    command?: string;
+    port?: number;
+    verbose?: boolean;
+    json?: boolean;
+}
+export declare function runExposeCommand(opts: ExposeCommandOptions): Promise<void>;
+export declare function runExposeStatusCommand(opts: {
+    json?: boolean;
+    showLink?: boolean;
+}): Promise<number>;
+export declare function runExposeStopCommand(opts: {
+    json?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=expose.d.ts.map

package/dist/cli/commands/expose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expose.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/expose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAqCD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDhF;AAyBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B1G;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpF"}

package/dist/cli/commands/expose.js

@@ -0,0 +1,200 @@
+/**
+ * `brigade expose` ( = `brigade bloody benchmark` ) — publish the gateway to
+ * the public internet through a secure tunnel.
+ *
+ * The gateway WebSocket is unauthenticated and loopback-only by design, so we
+ * never expose it directly. Instead we stand up a token-checking auth-proxy in
+ * front of it (`core/tunnel/auth-proxy.ts`) and tunnel THAT — the public URL
+ * carries a bearer token that the proxy enforces before any byte reaches the
+ * gateway. The gateway's localhost guard is untouched.
+ *
+ *   brigade expose                 — start a cloudflare quick tunnel (token auto-gen)
+ *   brigade expose --provider bore — self-hostable OSS tunnel
+ *   brigade expose --insecure      — NO token gate (loud warning; explicit opt-in)
+ *   brigade expose status          — show the active tunnel
+ *   brigade expose stop            — tear down the active tunnel
+ *
+ * This is a foreground, long-lived command: it holds the tunnel open until
+ * Ctrl-C (or `brigade expose stop` from another terminal).
+ */
+import process from "node:process";
+import { randomBytes } from "node:crypto";
+import chalk from "chalk";
+import { loadConfig } from "../../core/config.js";
+import { mutateConfigAtomic } from "../../config/io.js";
+import { isProcessAlive, probeGateway } from "../../core/gateway-probe.js";
+import { startTunnel } from "../../core/tunnel/manager.js";
+import { DEFAULT_PROVIDER, listProviderNames } from "../../core/tunnel/registry.js";
+import { clearTunnelState, readTunnelState } from "../../core/tunnel/state.js";
+import { DEFAULT_PORT, EXIT_FAILURE, EXIT_OK } from "../../protocol.js";
+const LOOPBACK_HOST = "127.0.0.1";
+/** Resolve the gateway port: flag → config → env → default. */
+function resolveGatewayPort(opts, cfg) {
+    if (typeof opts.port === "number" && opts.port > 0)
+        return opts.port;
+    const cfgPort = cfg.gateway?.port;
+    if (typeof cfgPort === "number" && cfgPort > 0)
+        return cfgPort;
+    const envPort = Number(process.env.BRIGADE_PORT);
+    if (Number.isInteger(envPort) && envPort > 0)
+        return envPort;
+    return DEFAULT_PORT;
+}
+/**
+ * Resolve the bearer token. `--insecure` → none. `--token` → that. Otherwise
+ * reuse `cfg.gateway.tunnel.token`, generating + persisting one on first run
+ * so the same URL+token survives restarts.
+ */
+async function resolveToken(opts, cfg) {
+    if (opts.insecure || opts.open)
+        return undefined;
+    if (opts.token && opts.token.trim())
+        return opts.token.trim();
+    const existing = cfg.gateway?.tunnel?.token;
+    if (typeof existing === "string" && existing.length > 0)
+        return existing;
+    const generated = randomBytes(24).toString("base64url");
+    await mutateConfigAtomic((current) => {
+        const next = { ...current };
+        const gateway = { ...(next.gateway ?? {}) };
+        const tunnel = { ...(gateway.tunnel ?? {}) };
+        tunnel.token = generated;
+        gateway.tunnel = tunnel;
+        next.gateway = gateway;
+        return next;
+    });
+    return generated;
+}
+export async function runExposeCommand(opts) {
+    const cfg = loadConfig();
+    const gatewayPort = resolveGatewayPort(opts, cfg);
+    const provider = (opts.provider ?? cfg.gateway?.tunnel?.provider ?? DEFAULT_PROVIDER).trim();
+    const relay = opts.relay ?? cfg.gateway?.tunnel?.relay;
+    const command = opts.command ?? cfg.gateway?.tunnel?.command;
+    if (!listProviderNames().includes(provider)) {
+        console.error(chalk.red(`Unknown tunnel provider "${provider}". Known: ${listProviderNames().join(", ")}.`));
+        process.exit(EXIT_FAILURE);
+    }
+    // The gateway must be up — the tunnel forwards to it. Probe before we open
+    // anything to the world.
+    const probe = await probeGateway({ host: LOOPBACK_HOST, port: gatewayPort });
+    if (!probe.reachable) {
+        console.error(chalk.red(`No gateway reachable on ${LOOPBACK_HOST}:${gatewayPort}.`));
+        console.error(chalk.dim("Start it first:  brigade gateway run"));
+        process.exit(EXIT_FAILURE);
+    }
+    // Refuse to silently re-expose if another tunnel is already live.
+    const existing = readTunnelState();
+    if (existing && isProcessAlive(existing.pid) && existing.pid !== process.pid) {
+        console.error(chalk.yellow(`A tunnel is already running (pid ${existing.pid}): ${existing.url}`));
+        console.error(chalk.dim("Stop it first:  brigade expose stop"));
+        process.exit(EXIT_FAILURE);
+    }
+    const token = await resolveToken(opts, cfg);
+    const onLog = opts.verbose ? (line) => console.error(chalk.dim(`  ${line}`)) : undefined;
+    console.error(chalk.cyan(`Opening ${provider} tunnel to the gateway on :${gatewayPort}…`));
+    let tunnel;
+    try {
+        tunnel = await startTunnel({ provider, gatewayHost: LOOPBACK_HOST, gatewayPort, token, relay, command, onLog });
+    }
+    catch (err) {
+        console.error(chalk.red(`Failed to open tunnel: ${err instanceof Error ? err.message : String(err)}`));
+        process.exit(EXIT_FAILURE);
+    }
+    printBanner(tunnel, provider);
+    // Tear down on Ctrl-C / SIGTERM so we never leave an orphaned public URL.
+    let shuttingDown = false;
+    const shutdown = async (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        console.error(chalk.dim(`\nClosing tunnel (${signal})…`));
+        await tunnel.stop().catch(() => { });
+        process.exit(EXIT_OK);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    // The build-program action holds the process open after we return.
+}
+function printBanner(tunnel, provider) {
+    const line = chalk.dim("─".repeat(68));
+    console.error("");
+    console.error(line);
+    console.error(`  ${chalk.bold("🌍 Your Brigade gateway is now public")}  ${chalk.dim(`(via ${provider})`)}`);
+    console.error("");
+    // Always show the CLEAN URL — the access key is never printed. It's
+    // generated + stored automatically; the operator never sees or types it.
+    console.error(`  ${chalk.bold("Public URL →")}  ${chalk.green.bold(tunnel.url)}`);
+    console.error("");
+    if (tunnel.secured) {
+        console.error(`  ${chalk.green("🔒 Secured automatically")} ${chalk.dim("— a private access key is saved to your config.")}`);
+        console.error(`  ${chalk.dim("You never type it. Need the full link for another device? ")}${chalk.cyan("brigade expose status --show-link")}`);
+    }
+    else {
+        console.error(`  ${chalk.red.bold("⚠ OPEN MODE: no key — ANYONE who finds this URL controls your crew.")}`);
+        console.error(`  ${chalk.dim("Drop --open to secure it automatically instead.")}`);
+    }
+    console.error("");
+    console.error(`  ${chalk.dim("Stop anytime: brigade expose stop  ·  or press Ctrl-C")}`);
+    console.error(line);
+    console.error("");
+}
+export async function runExposeStatusCommand(opts) {
+    const state = readTunnelState();
+    if (!state || !isProcessAlive(state.pid)) {
+        if (state)
+            await clearTunnelState().catch(() => { });
+        if (opts.json)
+            console.log(JSON.stringify({ running: false }));
+        else
+            console.log("No tunnel is running.");
+        return EXIT_OK;
+    }
+    // `--json` is for tooling and intentionally includes the full link (key and
+    // all). The human-readable view hides the key unless `--show-link`.
+    if (opts.json) {
+        console.log(JSON.stringify({ running: true, ...state }));
+        return EXIT_OK;
+    }
+    const uptimeS = Math.round((Date.now() - state.startedAt) / 1000);
+    console.log(chalk.bold("Tunnel running"));
+    console.log(`  provider   ${state.provider}`);
+    console.log(`  url        ${state.url}`);
+    if (state.secured && opts.showLink) {
+        console.log(`  full link  ${chalk.green(state.urlWithToken)}  ${chalk.dim("(includes access key — share carefully)")}`);
+    }
+    console.log(`  gateway    127.0.0.1:${state.gatewayPort}  (via auth-proxy :${state.proxyPort})`);
+    console.log(`  secured    ${state.secured ? chalk.green("yes (key handled automatically)") : chalk.red("NO (open mode)")}`);
+    if (state.secured && !opts.showLink) {
+        console.log(`  ${chalk.dim("(run with --show-link to reveal the full access link for another device)")}`);
+    }
+    console.log(`  pid        ${state.pid}`);
+    console.log(`  uptime     ${uptimeS}s`);
+    return EXIT_OK;
+}
+export async function runExposeStopCommand(opts) {
+    const state = readTunnelState();
+    if (!state) {
+        if (opts.json)
+            console.log(JSON.stringify({ stopped: false, reason: "no-tunnel" }));
+        else
+            console.log("No tunnel is running.");
+        return EXIT_OK;
+    }
+    if (isProcessAlive(state.pid)) {
+        try {
+            process.kill(state.pid, "SIGTERM");
+        }
+        catch (err) {
+            if (!opts.json)
+                console.error(chalk.red(`Failed to signal tunnel pid ${state.pid}: ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
+    await clearTunnelState().catch(() => { });
+    if (opts.json)
+        console.log(JSON.stringify({ stopped: true, pid: state.pid }));
+    else
+        console.log(chalk.green(`Tunnel stopped (pid ${state.pid}).`));
+    return EXIT_OK;
+}
+//# sourceMappingURL=expose.js.map

package/dist/cli/commands/expose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expose.js","sourceRoot":"","sources":["../../../src/cli/commands/expose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAexE,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,IAA0B,EAAE,GAAkC;IACxF,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAA0B,EAAE,GAAkC;IACxF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,kBAAkB,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;IAE7D,IAAI,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,QAAQ,aAAa,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,aAAa,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAY,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,8BAA8B,WAAW,GAAG,CAAC,CAAC,CAAC;IAE3F,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9B,0EAA0E;IAC1E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,mEAAmE;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,QAAgB;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,oEAAoE;IACpE,yEAAyE;IACzE,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;QAC9H,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,4DAA4D,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;IAClJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAA4C;IACvF,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK;YAAE,MAAM,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;;YAC1D,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,WAAW,sBAAsB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC5H,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB;IACjE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;;YAC/E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/program/build-program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-program.d.ts","sourceRoot":"","sources":["../../../src/cli/program/build-program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqGpC,wBAAgB,YAAY,IAAI,OAAO,CA4jDtC"}
+{"version":3,"file":"build-program.d.ts","sourceRoot":"","sources":["../../../src/cli/program/build-program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2GpC,wBAAgB,YAAY,IAAI,OAAO,CA+oDtC"}

package/dist/cli/program/build-program.js

@@ -46,6 +46,12 @@ const BOOT_OPTIONAL_PREFIXES = [
     "gateway uninstall",
     "gateway restart",
     "gateway supervise",
+    // `expose status/stop` just read the tunnel state file + a pid — they must
+    // work even when the storage backend is down (e.g. to tear down a tunnel).
+    "expose status",
+    "expose stop",
+    "bloody benchmark status",
+    "bloody benchmark stop",
     "store",
     "encrypt",
     "migrate",
@@ -334,6 +340,61 @@ export function buildProgram() {
             json: opts.json,
         }));
     });
+    // Shared option set so `expose` and `bloody benchmark` stay identical.
+    const addExposeOptions = (cmd) => cmd
+        .option("--provider <name>", "tunnel provider: cloudflare | bore | custom (default: cloudflare)")
+        .option("--token <token>", "bearer token required on the public URL (auto-generated + saved if omitted)")
+        .option("--open", "expose with NO token — anyone with the URL gets in (simplest, least safe)", false)
+        .option("--insecure", "alias for --open (NO token gate)", false)
+        .option("--relay <addr>", "self-hosted relay address (bore/custom providers)")
+        .option("--command <cmd>", "custom provider command template; {port} is replaced with the proxy port")
+        .option("-p, --port <port>", "gateway port to expose (default: config gateway.port or 7777)", (v) => parseInt(v, 10))
+        .option("-V, --verbose", "stream tunnel provider logs", false);
+    const runExpose = async (opts) => {
+        const { runExposeCommand } = await import("../commands/expose.js");
+        await runExposeCommand(opts);
+        await new Promise(() => { }); // hold the tunnel open until Ctrl-C
+    };
+    const expose = addExposeOptions(program.command("expose").description("Expose the gateway to the public internet via a secure tunnel")).action(runExpose);
+    expose
+        .command("status")
+        .description("Show the active tunnel (URL, provider, uptime)")
+        .option("--json", "emit JSON instead of human-readable text", false)
+        .option("--show-link", "reveal the full access link (includes the private key)", false)
+        .action(async (opts) => {
+        const { runExposeStatusCommand } = await import("../commands/expose.js");
+        await exitAfterFlush(await runExposeStatusCommand(opts));
+    });
+    expose
+        .command("stop")
+        .description("Tear down the active tunnel")
+        .option("--json", "emit JSON instead of human-readable text", false)
+        .action(async (opts) => {
+        const { runExposeStopCommand } = await import("../commands/expose.js");
+        await exitAfterFlush(await runExposeStopCommand(opts));
+    });
+    // Easter-egg alias: `brigade bloody benchmark [status|stop]` ≡ `brigade expose …`.
+    const bloody = program
+        .command("bloody")
+        .description("Alias group — `brigade bloody benchmark` opens a public tunnel (= `brigade expose`)");
+    const benchmark = addExposeOptions(bloody.command("benchmark").description("Expose the gateway to the public internet (alias for `brigade expose`)")).action(runExpose);
+    benchmark
+        .command("status")
+        .description("Show the active tunnel")
+        .option("--json", "emit JSON instead of human-readable text", false)
+        .option("--show-link", "reveal the full access link (includes the private key)", false)
+        .action(async (opts) => {
+        const { runExposeStatusCommand } = await import("../commands/expose.js");
+        await exitAfterFlush(await runExposeStatusCommand(opts));
+    });
+    benchmark
+        .command("stop")
+        .description("Tear down the active tunnel")
+        .option("--json", "emit JSON instead of human-readable text", false)
+        .action(async (opts) => {
+        const { runExposeStopCommand } = await import("../commands/expose.js");
+        await exitAfterFlush(await runExposeStopCommand(opts));
+    });
     /* ─────────────────────────────── connect ─────────────────────────────── */
     program
         .command("connect")