@tomflow/proflow-dev-tunnel 0.1.20 → 0.1.22

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-dev-tunnel
 
+## 0.1.22
+
+### Patch Changes
+
+- Accept Microsoft Dev Tunnel canonical cluster suffixes while preserving the deterministic workspace Tunnel identity.
+
+## 0.1.21
+
+### Patch Changes
+
+- Integrate package-local Microsoft Dev Tunnel CLI ownership and deterministic Fresh Tunnel recovery.
+
 ## 0.1.20
 
 ### Patch Changes

package/README.md

@@ -23,6 +23,8 @@ Deployment Governance
 
 ## Purpose
 
-Manages the Microsoft Dev Tunnel (`devtunnel`) public HTTPS ingress. Existing
-login is reused; when login is unavailable, the only human action is GitHub
-browser authorization initiated by the provider CLI. Account state is never faked.
+Manages the Microsoft Dev Tunnel (`devtunnel`) public HTTPS ingress. The Module
+owns acquisition of the pinned official CLI into its own package-local `.devtunnel/`
+directory and never resolves a system PATH `devtunnel`. Existing login is reused;
+when login is unavailable, the only human action is GitHub browser authorization
+initiated by the package-owned CLI. Account state is never faked.

package/SETUP.md

@@ -15,7 +15,7 @@ Human action: 仅当现有登录无效时，在 `devtunnel user login --github -
 Automatic flow:
 
 ```text
-检查 CLI 和登录
+准备/复用 dev-tunnel 包目录内的官方 CLI，并检查登录
 → 必要时完成 GitHub browser auth 并复核登录
 → 复用 workspace-owned Tunnel 或自动创建
 → 从 agent-gateway shared facts 读取本地端口

package/dist/deployment/adapter.d.ts

@@ -7,14 +7,15 @@ type SetupState = {
     phase: SetupPhase;
     gatewayPort?: number;
     publicBaseUrl?: string;
-    cliPath?: string;
 };
 type RuntimeFactory = (input: {
     command?: string;
     tunnelId?: string;
     publicBaseUrl?: string;
     processStateFile?: string;
+    loginVerified?: boolean;
 }) => DevTunnelRuntime;
+export declare function workspaceTunnelId(workspaceRoot: string): string;
 export declare function createDevTunnelBehaviorAdapter(dependencies?: {
     automation?: DevTunnelAutomation;
     createRuntime?: RuntimeFactory;
@@ -27,7 +28,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: never[];
     }>;
@@ -37,14 +38,14 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: string[];
     } | {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -61,7 +62,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: {
                 setupStatus: "ACTION_REQUIRED" | "READY";
                 runtimeStatus: "FAILED" | "RUNNING" | "STOPPED";
@@ -88,7 +89,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: {
                 docs: string;
             };
@@ -99,7 +100,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -115,7 +116,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: import("../src/resource-adapter.ts").DevTunnelObservation;
         };
         observedEffects: string[];
@@ -126,14 +127,14 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: string[];
     } | {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -148,7 +149,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -164,7 +165,7 @@ export declare function createDevTunnelBehaviorAdapter(dependencies?: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: SetupState;
         };
         observedEffects: string[];
@@ -177,7 +178,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: never[];
     }>;
@@ -187,14 +188,14 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: string[];
     } | {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -211,7 +212,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: {
                 setupStatus: "ACTION_REQUIRED" | "READY";
                 runtimeStatus: "FAILED" | "RUNNING" | "STOPPED";
@@ -238,7 +239,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: {
                 docs: string;
             };
@@ -249,7 +250,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -265,7 +266,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: import("../src/resource-adapter.ts").DevTunnelObservation;
         };
         observedEffects: string[];
@@ -276,14 +277,14 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "dev-tunnel";
-            readonly moduleVersion: "0.1.20";
+            readonly moduleVersion: "0.1.22";
         };
         observedEffects: string[];
     } | {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -298,7 +299,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             ok: false;
             status: "FAILED";
             error: {
@@ -314,7 +315,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "dev-tunnel";
-            moduleVersion: "0.1.20";
+            moduleVersion: "0.1.22";
             data: SetupState;
         };
         observedEffects: string[];

package/dist/deployment/adapter.js

@@ -1,9 +1,10 @@
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { resolveDevTunnelCli } from "@tomflow/proflow-devtunnel-cli";
 import { readModuleSharedFacts, writeModuleSharedFacts, } from "@tomflow/proflow-module-contract";
 import { createDevTunnelAutomation, createDevTunnelRuntime, verifyProvisionedPublicBaseUrl, } from "../src/resource-adapter.js";
+import { devTunnelCliPath, resolveDevTunnelCli } from "../src/cli-resolver.js";
 import { descriptor } from "./descriptor.js";
 const base = {
     contract: "deployment.result.v1",
@@ -47,7 +48,6 @@ async function readState(context) {
                 Number(gatewayPort) > 65_535))
             return undefined;
         const publicBaseUrl = raw.publicBaseUrl;
-        const cliPath = raw.cliPath;
         if (raw.phase === "READY") {
             if (typeof publicBaseUrl !== "string")
                 return undefined;
@@ -61,7 +61,6 @@ async function readState(context) {
             phase: raw.phase,
             ...(typeof gatewayPort === "number" ? { gatewayPort } : {}),
             ...(typeof publicBaseUrl === "string" ? { publicBaseUrl } : {}),
-            ...(typeof cliPath === "string" ? { cliPath } : {}),
         };
     }
     catch {
@@ -77,7 +76,7 @@ async function writeState(context, state) {
 }
 function runtime(context, state) {
     return createDevTunnelRuntime({
-        ...(state?.cliPath ? { command: state.cliPath } : {}),
+        command: devTunnelCliPath(),
         ...(state
             ? { tunnelId: state.tunnelId, publicBaseUrl: state.publicBaseUrl }
             : {}),
@@ -235,22 +234,22 @@ const baseBehaviorAdapter = {
                 observedEffects: [],
             };
         const rt = runtime(context, state);
-        if ((await rt.loginStatus()) !== "LOGGED_IN")
-            return {
-                result: {
-                    ...base,
-                    ok: false,
-                    status: "FAILED",
-                    error: {
-                        code: "START_FAILED",
-                        message: "Microsoft Dev Tunnel login is not ready",
-                        retryable: true,
-                    },
-                },
-                observedEffects: [],
-            };
         try {
             const observed = await rt.start();
+            if (observed.login !== "LOGGED_IN")
+                return {
+                    result: {
+                        ...base,
+                        ok: false,
+                        status: "FAILED",
+                        error: {
+                            code: "START_FAILED",
+                            message: "Microsoft Dev Tunnel login is not ready",
+                            retryable: true,
+                        },
+                    },
+                    observedEffects: [],
+                };
             return observed.state === "RUNNING"
                 ? {
                     result: { ...base, data: observed },
@@ -343,6 +342,13 @@ function gatewayPort(facts) {
         throw new Error("agent-gateway localBaseUrl shared fact is invalid");
     return port;
 }
+export function workspaceTunnelId(workspaceRoot) {
+    const digest = createHash("sha256")
+        .update(resolve(workspaceRoot))
+        .digest("hex")
+        .slice(0, 24);
+    return `proflow-${digest}`;
+}
 const setupFailed = (error) => ({
     result: {
         ...base,
@@ -364,11 +370,10 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
         setup: async (context) => {
             try {
                 const previous = await readState(context);
-                const cliPath = previous?.cliPath ??
-                    (dependencies?.automation
-                        ? "devtunnel"
-                        : await (dependencies?.resolveCli ??
-                            (async (workspaceRoot) => (await resolveDevTunnelCli({ workspaceRoot })).command))(context.workspaceRoot));
+                const cliPath = dependencies?.automation
+                    ? devTunnelCliPath()
+                    : await (dependencies?.resolveCli ??
+                        (async () => (await resolveDevTunnelCli()).command))(context.workspaceRoot);
                 const automation = dependencies?.automation ??
                     createDevTunnelAutomation({ command: cliPath });
                 await mkdir(stateDir(context), { recursive: true, mode: 0o700 });
@@ -376,20 +381,33 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
                 await automation.ensureLogin();
                 let tunnelId;
                 let safeToStartNewHost = false;
-                const createAndVerifyTunnel = async () => {
-                    const createdTunnelId = await automation.createTunnel();
-                    const created = await automation.inspectTunnel(createdTunnelId);
-                    if (created.state !== "EXISTS")
-                        throw new Error("new Dev Tunnel could not be verified by show --json");
+                const stableTunnelId = workspaceTunnelId(context.workspaceRoot);
+                const createAndVerifyTunnel = async (targetTunnelId) => {
+                    const createdTunnelId = await automation.createTunnel(targetTunnelId);
+                    if (createdTunnelId !== targetTunnelId)
+                        throw new Error("Dev Tunnel create returned an unexpected tunnelId");
                     await writeState(context, {
                         contract: "proflow.dev-tunnel-setup.v2",
                         tunnelId: createdTunnelId,
                         phase: "PENDING_CREATED",
                         gatewayPort: port,
-                        cliPath,
                     });
+                    const created = await automation.inspectTunnel(createdTunnelId);
+                    if (created.state !== "EXISTS")
+                        throw new Error("new Dev Tunnel could not be verified by show --json");
                     return createdTunnelId;
                 };
+                const resolveStableTunnel = async () => {
+                    const inspected = await automation.inspectTunnel(stableTunnelId);
+                    if (inspected.state === "UNKNOWN")
+                        throw new Error("workspace Tunnel remote state is UNKNOWN");
+                    if (inspected.state === "EXISTS")
+                        return { tunnelId: stableTunnelId, hostState: inspected.hostState };
+                    return {
+                        tunnelId: await createAndVerifyTunnel(stableTunnelId),
+                        hostState: "STOPPED",
+                    };
+                };
                 if (previous) {
                     const inspected = await automation.inspectTunnel(previous.tunnelId);
                     if (inspected.state === "UNKNOWN")
@@ -399,13 +417,15 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
                         safeToStartNewHost = inspected.hostState === "STOPPED";
                     }
                     else {
-                        tunnelId = await createAndVerifyTunnel();
-                        safeToStartNewHost = true;
+                        const resolved = await resolveStableTunnel();
+                        tunnelId = resolved.tunnelId;
+                        safeToStartNewHost = resolved.hostState === "STOPPED";
                     }
                 }
                 else {
-                    tunnelId = await createAndVerifyTunnel();
-                    safeToStartNewHost = true;
+                    const resolved = await resolveStableTunnel();
+                    tunnelId = resolved.tunnelId;
+                    safeToStartNewHost = resolved.hostState === "STOPPED";
                 }
                 await automation.ensurePort(tunnelId, port);
                 await writeState(context, {
@@ -413,11 +433,12 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
                     tunnelId,
                     phase: "PORT_READY",
                     gatewayPort: port,
-                    cliPath,
                 });
                 const host = createRuntime({
+                    command: cliPath,
                     tunnelId,
                     processStateFile: processFile(context),
+                    loginVerified: true,
                 });
                 const observed = await host.status();
                 let started = false;
@@ -434,7 +455,6 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
                     tunnelId,
                     phase: "HOST_READY",
                     gatewayPort: port,
-                    cliPath,
                 });
                 const publicBaseUrl = await automation.discoverPublicBaseUrl(tunnelId, port);
                 const url = new URL(publicBaseUrl);
@@ -447,7 +467,6 @@ export function createDevTunnelBehaviorAdapter(dependencies) {
                     phase: "READY",
                     gatewayPort: port,
                     publicBaseUrl: url.href,
-                    cliPath,
                 };
                 await writeState(context, state);
                 await writeModuleSharedFacts(context, descriptor.moduleRef, {

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "dev-tunnel";
     readonly packageName: "@tomflow/proflow-dev-tunnel";
-    readonly moduleVersion: "0.1.20";
+    readonly moduleVersion: "0.1.22";
     readonly kind: "external-resource";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "dev-tunnel",
     packageName: "@tomflow/proflow-dev-tunnel",
-    moduleVersion: "0.1.20",
+    moduleVersion: "0.1.22",
     kind: "external-resource",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",

package/dist/src/cli-resolver.d.ts

@@ -0,0 +1,7 @@
+export declare const MANAGED_DEV_TUNNEL_VERSION = "1.0.2030";
+export declare function devTunnelCliPath(): string;
+export declare function resolveDevTunnelCli(): Promise<{
+    command: string;
+    source: "package";
+    version: string;
+}>;

package/dist/src/cli-resolver.js

@@ -0,0 +1,145 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { arch, platform } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { promisify } from "node:util";
+const execute = promisify(execFile);
+export const MANAGED_DEV_TUNNEL_VERSION = "1.0.2030";
+const VERSION_PROBE_TIMEOUT_MS = 30_000;
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+const COMPATIBLE_VERSION = new RegExp(`^${MANAGED_DEV_TUNNEL_VERSION.replaceAll(".", "\\.")}$`);
+function artifact() {
+    const key = `${platform()}-${arch()}`;
+    const artifacts = {
+        "darwin-x64": {
+            url: "https://aka.ms/TunnelsCliDownload/osx-x64-zip",
+            archive: "zip",
+            executable: "devtunnel",
+            sha256: "4a7d426df3edb63441f24f0b465d3642da284c982e88eed9a410033379fad33f",
+        },
+        "darwin-arm64": {
+            url: "https://aka.ms/TunnelsCliDownload/osx-arm64-zip",
+            archive: "zip",
+            executable: "devtunnel",
+            sha256: "41794a24ccee6c5dc2821fadc97285ee39894fdbd96ad9869ee62ae0d7c5c8ed",
+        },
+        "linux-x64": {
+            url: "https://aka.ms/TunnelsCliDownload/linux-x64",
+            archive: "binary",
+            executable: "devtunnel",
+            sha256: "ff6911548907b5abaea4ed5baa36b2420be7c5debcb637a4f50f7a4002b10b60",
+        },
+        "win32-x64": {
+            url: "https://aka.ms/TunnelsCliDownload/win-x64",
+            archive: "binary",
+            executable: "devtunnel.exe",
+            sha256: "78190ac81c664828858de2390fd9c15eeec0e4edfe4e7b0d6a323dc49df625db",
+        },
+    };
+    const selected = artifacts[key];
+    if (!selected)
+        throw new Error(`DEV_TUNNEL_PLATFORM_UNSUPPORTED: ${key}`);
+    return selected;
+}
+function packageRoot() {
+    const parent = dirname(import.meta.dirname);
+    return basename(parent) === "dist" ? dirname(parent) : parent;
+}
+export function devTunnelCliPath() {
+    const selected = artifact();
+    return join(packageRoot(), ".devtunnel", MANAGED_DEV_TUNNEL_VERSION, `${platform()}-${arch()}`, selected.executable);
+}
+async function version(command) {
+    try {
+        const result = await execute(command, ["--version"], {
+            timeout: VERSION_PROBE_TIMEOUT_MS,
+        });
+        return `${result.stdout}\n${result.stderr}`.match(/\d+\.\d+\.\d+/)?.[0];
+    }
+    catch {
+        return undefined;
+    }
+}
+async function sha256(path) {
+    return createHash("sha256").update(await readFile(path)).digest("hex");
+}
+async function validCached(path) {
+    try {
+        const metadata = JSON.parse(await readFile(`${path}.json`, "utf8"));
+        if (typeof metadata !== "object" || metadata === null)
+            return false;
+        const expected = Reflect.get(metadata, "sha256");
+        return (typeof expected === "string" &&
+            expected === (await sha256(path)) &&
+            COMPATIBLE_VERSION.test((await version(path)) ?? ""));
+    }
+    catch {
+        return false;
+    }
+}
+async function downloadManaged() {
+    const selected = artifact();
+    const target = devTunnelCliPath();
+    const directory = dirname(target);
+    if (await validCached(target))
+        return target;
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    let response;
+    try {
+        response = await fetch(selected.url, {
+            redirect: "follow",
+            signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new Error(`DEV_TUNNEL_DOWNLOAD_FAILED: ${error instanceof Error ? error.message : "request failed"}`);
+    }
+    if (!response.ok)
+        throw new Error(`DEV_TUNNEL_DOWNLOAD_FAILED: HTTP ${response.status}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const temporary = `${target}.${process.pid}.download`;
+    const extraction = `${directory}/extract-${process.pid}`;
+    try {
+        await writeFile(temporary, bytes, { mode: 0o600 });
+        if ((await sha256(temporary)) !== selected.sha256)
+            throw new Error("DEV_TUNNEL_DOWNLOAD_CHECKSUM_MISMATCH");
+        if (selected.archive === "zip") {
+            await mkdir(extraction, { recursive: true, mode: 0o700 });
+            await execute("unzip", ["-oq", temporary, "-d", extraction], {
+                timeout: 30_000,
+            });
+            const extracted = join(extraction, selected.executable);
+            await stat(extracted);
+            await rename(extracted, target);
+        }
+        else {
+            await rename(temporary, target);
+        }
+    }
+    finally {
+        await rm(temporary, { force: true });
+        await rm(extraction, { recursive: true, force: true });
+    }
+    if (platform() !== "win32")
+        await chmod(target, 0o700);
+    const observedVersion = await version(target);
+    if (!observedVersion || !COMPATIBLE_VERSION.test(observedVersion))
+        throw new Error(`DEV_TUNNEL_VERSION_INCOMPATIBLE: ${observedVersion ?? "unknown"}`);
+    await writeFile(`${target}.json`, `${JSON.stringify({
+        source: selected.url,
+        version: observedVersion,
+        sha256: await sha256(target),
+        artifactSha256: selected.sha256,
+        file: basename(target),
+        directory: dirname(target),
+    }, null, 2)}\n`, { mode: 0o600 });
+    return target;
+}
+export async function resolveDevTunnelCli() {
+    const command = await downloadManaged();
+    const managedVersion = await version(command);
+    if (!managedVersion)
+        throw new Error("DEV_TUNNEL_MANAGED_CLI_INVALID");
+    return { command, source: "package", version: managedVersion };
+}

package/dist/src/resource-adapter.d.ts

@@ -26,7 +26,7 @@ export type DevTunnelInspection = {
 export interface DevTunnelAutomation {
     ensureLogin(): Promise<"LOGGED_IN">;
     inspectTunnel(tunnelId: string): Promise<DevTunnelInspection>;
-    createTunnel(): Promise<string>;
+    createTunnel(tunnelId: string): Promise<string>;
     ensurePort(tunnelId: string, port: number): Promise<"REUSED" | "CREATED" | "UPDATED">;
     discoverPublicBaseUrl(tunnelId: string, port: number): Promise<string>;
 }
@@ -60,6 +60,7 @@ export declare function createDevTunnelRuntime(input: {
     publicBaseUrl?: string;
     runCommand?: CommandRunner;
     processStateFile?: string;
+    loginVerified?: boolean;
 }): DevTunnelRuntime;
 export interface IngressCheck {
     id: string;

package/dist/src/resource-adapter.js

@@ -6,6 +6,8 @@ import { z } from "zod";
 const LOGIN_ARGS = ["user", "show", "--json"];
 const LOGIN_TIMEOUT_MS = 30_000;
 const REMOTE_COMMAND_TIMEOUT_MS = 30_000;
+const REMOTE_QUERY_TIMEOUT_MS = 45_000;
+const REMOTE_QUERY_RETRY_DELAY_MS = 250;
 const START_CONFIRM_MS = 500;
 function defaultCommandRunner(command, args, options) {
     if (options?.interactive) {
@@ -92,6 +94,14 @@ function parseTunnel(input) {
     return z.object({ tunnel: tunnelPayloadSchema }).passthrough().parse(input)
         .tunnel;
 }
+function sameTunnelIdentity(requested, observed) {
+    if (observed === requested)
+        return true;
+    if (requested.includes("."))
+        return false;
+    const prefix = `${requested}.`;
+    return observed.startsWith(prefix) && !observed.slice(prefix.length).includes(".");
+}
 function parseJson(text, label) {
     try {
         return JSON.parse(text);
@@ -171,6 +181,16 @@ function assertCommandSucceeded(result, label) {
 export function createDevTunnelAutomation(input) {
     const command = input?.command ?? "devtunnel";
     const run = input?.runCommand ?? defaultCommandRunner;
+    const runRemoteQuery = async (args, retryTimeout = true) => {
+        let result = await run(command, args, { timeoutMs: REMOTE_QUERY_TIMEOUT_MS });
+        if (!retryTimeout ||
+            result.exitCode !== null ||
+            !/timed out/i.test(commandText(result)))
+            return result;
+        await new Promise((resolve) => setTimeout(resolve, REMOTE_QUERY_RETRY_DELAY_MS));
+        result = await run(command, args, { timeoutMs: REMOTE_QUERY_TIMEOUT_MS });
+        return result;
+    };
     const loginStatus = async () => {
         let result;
         try {
@@ -205,9 +225,7 @@ export function createDevTunnelAutomation(input) {
             return after;
         },
         async inspectTunnel(tunnelId) {
-            const result = await run(command, ["show", tunnelId, "--json"], {
-                timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
-            });
+            const result = await runRemoteQuery(["show", tunnelId, "--json"]);
             if (result.exitCode !== 0) {
                 return /not found|does not exist|could not be found/i.test(commandText(result))
                     ? { state: "MISSING", hostState: "UNKNOWN" }
@@ -215,7 +233,7 @@ export function createDevTunnelAutomation(input) {
             }
             try {
                 const tunnel = parseTunnel(parseJson(result.stdout, "devtunnel show --json"));
-                if (tunnel.tunnelId !== tunnelId)
+                if (!sameTunnelIdentity(tunnelId, tunnel.tunnelId))
                     return { state: "UNKNOWN", hostState: "UNKNOWN" };
                 const hostState = tunnel.hostConnections !== undefined
                     ? tunnel.hostConnections > 0
@@ -232,16 +250,16 @@ export function createDevTunnelAutomation(input) {
                 return { state: "UNKNOWN", hostState: "UNKNOWN" };
             }
         },
-        async createTunnel() {
-            const result = await run(command, ["create", "--allow-anonymous", "--json"], { timeoutMs: REMOTE_COMMAND_TIMEOUT_MS });
+        async createTunnel(tunnelId) {
+            const result = await run(command, ["create", tunnelId, "--allow-anonymous", "--json"], { timeoutMs: REMOTE_COMMAND_TIMEOUT_MS });
             assertCommandSucceeded(result, "devtunnel create --json");
             const tunnel = parseTunnel(parseJson(result.stdout, "devtunnel create --json"));
-            return tunnel.tunnelId;
+            if (!sameTunnelIdentity(tunnelId, tunnel.tunnelId))
+                throw new Error("devtunnel create returned an unexpected tunnelId");
+            return tunnelId;
         },
         async ensurePort(tunnelId, port) {
-            const listed = await run(command, ["port", "list", tunnelId, "--json"], {
-                timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
-            });
+            const listed = await runRemoteQuery(["port", "list", tunnelId, "--json"]);
             assertCommandSucceeded(listed, "devtunnel port list --json");
             const existing = parsePorts(parseJson(listed.stdout, "devtunnel port list --json")).find((item) => item.portNumber === port);
             if (existing?.protocol?.toLowerCase() === "http")
@@ -271,9 +289,7 @@ export function createDevTunnelAutomation(input) {
         async discoverPublicBaseUrl(tunnelId, port) {
             let lastError;
             for (let attempt = 0; attempt < 3; attempt += 1) {
-                const shown = await run(command, ["show", tunnelId, "--json"], {
-                    timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
-                });
+                const shown = await runRemoteQuery(["show", tunnelId, "--json"], false);
                 assertCommandSucceeded(shown, "devtunnel show --json");
                 try {
                     return discoverPublicBaseUrl(parseJson(shown.stdout, "devtunnel show --json"), port);
@@ -432,7 +448,7 @@ export function createDevTunnelRuntime(input) {
         loginStatus: () => observeLogin(),
         publicBaseUrl: () => publicBaseUrl,
         async start() {
-            const login = await observeLogin();
+            const login = input.loginVerified ? "LOGGED_IN" : await observeLogin();
             if (login !== "LOGGED_IN")
                 return observation("UNKNOWN", login);
             if (tunnelId === undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-dev-tunnel",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -23,8 +23,7 @@
   ],
   "dependencies": {
     "zod": "4.1.12",
-    "@tomflow/proflow-module-contract": "^0.1.13",
-    "@tomflow/proflow-devtunnel-cli": "^0.1.1"
+    "@tomflow/proflow-module-contract": "^0.1.13"
   },
   "devDependencies": {
     "@tomflow/proflow-deployment-conformance": "^0.1.13"

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "dev-tunnel",
 	"packageName": "@tomflow/proflow-dev-tunnel",
-	"moduleVersion": "0.1.20",
+	"moduleVersion": "0.1.22",
 	"kind": "external-resource",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",