@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/terminal/sandbox/index.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxFactory = exports.MacOSSandbox = exports.BubblewrapSandbox = void 0;
+/**
+ * Cross-platform Sandbox Factory
+ *
+ * Automatically selects the appropriate sandbox technology for the current platform:
+ * - Linux: bubblewrap (namespace isolation)
+ * - macOS: sandbox-exec (Seatbelt)
+ * - Windows: none (fallback)
+ */
+const child_process_1 = require("child_process");
+const global_logger_factory_1 = require("global-logger-factory");
+const BubblewrapSandbox_1 = require("./BubblewrapSandbox");
+const MacOSSandbox_1 = require("./MacOSSandbox");
+__exportStar(require("./types"), exports);
+var BubblewrapSandbox_2 = require("./BubblewrapSandbox");
+Object.defineProperty(exports, "BubblewrapSandbox", { enumerable: true, get: function () { return BubblewrapSandbox_2.BubblewrapSandbox; } });
+var MacOSSandbox_2 = require("./MacOSSandbox");
+Object.defineProperty(exports, "MacOSSandbox", { enumerable: true, get: function () { return MacOSSandbox_2.MacOSSandbox; } });
+/**
+ * No-op sandbox that runs processes without isolation.
+ * Used as fallback when no sandbox technology is available.
+ */
+class NoSandbox {
+    isAvailable() {
+        return true;
+    }
+    launch(config) {
+        const childProcess = (0, child_process_1.spawn)(config.command, config.args, {
+            cwd: config.workdir,
+            env: {
+                ...process.env,
+                ...config.env,
+                TERM: 'xterm-256color',
+            },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return {
+            process: childProcess,
+            sandboxed: false,
+            technology: 'none',
+        };
+    }
+}
+/**
+ * Sandbox Factory
+ */
+class SandboxFactory {
+    /**
+     * Get the best available sandbox for the current platform.
+     */
+    static getSandbox() {
+        if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {
+            return this.bubblewrap;
+        }
+        if (process.platform === 'darwin' && this.macos.isAvailable()) {
+            return this.macos;
+        }
+        this.logger.warn(`No sandbox available for platform ${process.platform}`);
+        return this.noSandbox;
+    }
+    /**
+     * Launch a sandboxed process.
+     */
+    static launch(config) {
+        return this.getSandbox().launch(config);
+    }
+    /**
+     * Check if sandbox is available.
+     */
+    static isAvailable() {
+        if (process.platform === 'linux') {
+            return this.bubblewrap.isAvailable();
+        }
+        if (process.platform === 'darwin') {
+            return this.macos.isAvailable();
+        }
+        return false;
+    }
+    /**
+     * Get the sandbox technology name.
+     */
+    static getTechnology() {
+        if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {
+            return 'bubblewrap';
+        }
+        if (process.platform === 'darwin' && this.macos.isAvailable()) {
+            return 'sandbox-exec';
+        }
+        return 'none';
+    }
+}
+exports.SandboxFactory = SandboxFactory;
+SandboxFactory.logger = (0, global_logger_factory_1.getLoggerFor)('SandboxFactory');
+SandboxFactory.bubblewrap = new BubblewrapSandbox_1.BubblewrapSandbox();
+SandboxFactory.macos = new MacOSSandbox_1.MacOSSandbox();
+SandboxFactory.noSandbox = new NoSandbox();
+//# sourceMappingURL=index.js.map

package/dist/terminal/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;;GAOG;AACH,iDAAsC;AACtC,iEAAqD;AAErD,2DAAwD;AACxD,iDAA8C;AAE9C,0CAAwB;AACxB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB;;;GAGG;AACH,MAAM,SAAS;IACN,WAAW;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YACtD,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAa,cAAc;IAOzB;;OAEG;IACI,MAAM,CAAC,UAAU;QACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,MAAqB;QACxC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,aAAa;QACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAtDH,wCAuDC;AAtD2B,qBAAM,GAAG,IAAA,oCAAY,EAAC,gBAAgB,CAAC,CAAC;AAEnD,yBAAU,GAAG,IAAI,qCAAiB,EAAE,CAAC;AACrC,oBAAK,GAAG,IAAI,2BAAY,EAAE,CAAC;AAC3B,wBAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["/**\n * Cross-platform Sandbox Factory\n *\n * Automatically selects the appropriate sandbox technology for the current platform:\n * - Linux: bubblewrap (namespace isolation)\n * - macOS: sandbox-exec (Seatbelt)\n * - Windows: none (fallback)\n */\nimport { spawn } from 'child_process';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\nimport { BubblewrapSandbox } from './BubblewrapSandbox';\nimport { MacOSSandbox } from './MacOSSandbox';\n\nexport * from './types';\nexport { BubblewrapSandbox } from './BubblewrapSandbox';\nexport { MacOSSandbox } from './MacOSSandbox';\n\n/**\n * No-op sandbox that runs processes without isolation.\n * Used as fallback when no sandbox technology is available.\n */\nclass NoSandbox implements Sandbox {\n  public isAvailable(): boolean {\n    return true;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const childProcess = spawn(config.command, config.args, {\n      cwd: config.workdir,\n      env: {\n        ...process.env,\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: false,\n      technology: 'none',\n    };\n  }\n}\n\n/**\n * Sandbox Factory\n */\nexport class SandboxFactory {\n  protected static readonly logger = getLoggerFor('SandboxFactory');\n\n  private static bubblewrap = new BubblewrapSandbox();\n  private static macos = new MacOSSandbox();\n  private static noSandbox = new NoSandbox();\n\n  /**\n   * Get the best available sandbox for the current platform.\n   */\n  public static getSandbox(): Sandbox {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return this.bubblewrap;\n    }\n\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return this.macos;\n    }\n\n    this.logger.warn(`No sandbox available for platform ${process.platform}`);\n    return this.noSandbox;\n  }\n\n  /**\n   * Launch a sandboxed process.\n   */\n  public static launch(config: SandboxConfig): SandboxResult {\n    return this.getSandbox().launch(config);\n  }\n\n  /**\n   * Check if sandbox is available.\n   */\n  public static isAvailable(): boolean {\n    if (process.platform === 'linux') {\n      return this.bubblewrap.isAvailable();\n    }\n    if (process.platform === 'darwin') {\n      return this.macos.isAvailable();\n    }\n    return false;\n  }\n\n  /**\n   * Get the sandbox technology name.\n   */\n  public static getTechnology(): 'bubblewrap' | 'sandbox-exec' | 'none' {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return 'bubblewrap';\n    }\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return 'sandbox-exec';\n    }\n    return 'none';\n  }\n}\n"]}

package/dist/terminal/sandbox/types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Sandbox Types for Terminal Sidecar
+ *
+ * Common interface for cross-platform sandboxing.
+ */
+import { ChildProcess } from 'child_process';
+export interface SandboxConfig {
+    /** Working directory to allow access (user must have acl:Control) */
+    workdir: string;
+    /** Command to execute inside sandbox */
+    command: string;
+    /** Command arguments */
+    args: string[];
+    /** Environment variables */
+    env: Record<string, string>;
+    /** Whether to isolate network (default: false) */
+    isolateNetwork?: boolean;
+    /** Additional read-only paths */
+    readonlyPaths?: string[];
+}
+export interface SandboxResult {
+    /** The spawned child process */
+    process: ChildProcess;
+    /** Whether the process is running in a sandbox */
+    sandboxed: boolean;
+    /** The sandbox technology used */
+    technology: 'bubblewrap' | 'sandbox-exec' | 'none';
+}
+export interface Sandbox {
+    /**
+     * Check if this sandbox technology is available on the current system.
+     */
+    isAvailable(): boolean;
+    /**
+     * Launch a sandboxed process.
+     */
+    launch(config: SandboxConfig): SandboxResult;
+}

package/dist/terminal/sandbox/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/terminal/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Sandbox Types for Terminal Sidecar\n *\n * Common interface for cross-platform sandboxing.\n */\nimport { ChildProcess } from 'child_process';\n\nexport interface SandboxConfig {\n  /** Working directory to allow access (user must have acl:Control) */\n  workdir: string;\n  /** Command to execute inside sandbox */\n  command: string;\n  /** Command arguments */\n  args: string[];\n  /** Environment variables */\n  env: Record<string, string>;\n  /** Whether to isolate network (default: false) */\n  isolateNetwork?: boolean;\n  /** Additional read-only paths */\n  readonlyPaths?: string[];\n}\n\nexport interface SandboxResult {\n  /** The spawned child process */\n  process: ChildProcess;\n  /** Whether the process is running in a sandbox */\n  sandboxed: boolean;\n  /** The sandbox technology used */\n  technology: 'bubblewrap' | 'sandbox-exec' | 'none';\n}\n\nexport interface Sandbox {\n  /**\n   * Check if this sandbox technology is available on the current system.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Launch a sandboxed process.\n   */\n  launch(config: SandboxConfig): SandboxResult;\n}\n"]}

package/dist/terminal/types.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Terminal Sidecar Types
+ */
+export type SessionStatus = 'active' | 'idle' | 'terminated';
+export interface TerminalPermissions {
+    /** Allowed working directories */
+    allowedWorkdirs: string[];
+    /** Secrets to inject as environment variables */
+    injectSecrets: string[];
+    /** Maximum session duration in seconds */
+    maxSessionDuration: number;
+    /** Network access domains (for bubblewrap) */
+    networkAccess?: string[];
+}
+export interface SessionConfig {
+    /** Command to execute (must be in TRUSTED_AGENTS) */
+    command: string;
+    /** Command arguments */
+    args: string[];
+    /** Working directory */
+    workdir: string;
+    /** Environment variables to inject */
+    env: Record<string, string | EnvRef>;
+    /** Session timeout in seconds */
+    timeout: number;
+}
+export interface EnvRef {
+    '@ref': string;
+    jsonPath: string;
+}
+export interface Session {
+    sessionId: string;
+    userId: string;
+    command: string;
+    workdir: string;
+    status: SessionStatus;
+    createdAt: Date;
+    expiresAt: Date;
+    ptyPid?: number;
+}
+export interface CreateSessionRequest {
+    command: string;
+    args?: string[];
+    workdir?: string;
+    env?: Record<string, string | EnvRef>;
+    timeout?: number;
+}
+export interface CreateSessionResponse {
+    sessionId: string;
+    status: SessionStatus;
+    wsUrl: string;
+    createdAt: string;
+    expiresAt: string;
+}
+export type ClientMessageType = 'input' | 'resize' | 'signal' | 'ping' | 'permission_response';
+export type ServerMessageType = 'output' | 'exit' | 'error' | 'pong' | 'permission_request';
+export interface ClientMessage {
+    type: ClientMessageType;
+    data?: string;
+    cols?: number;
+    rows?: number;
+    signal?: string;
+    requestId?: string;
+    granted?: boolean;
+}
+export interface ServerMessage {
+    type: ServerMessageType;
+    data?: string;
+    code?: number | string;
+    signal?: string;
+    message?: string;
+    requestId?: string;
+    description?: string;
+    action?: string;
+    resource?: string;
+    timeout?: number;
+}
+export declare const TRUSTED_AGENTS: readonly ["claude", "codex", "aider", "codebuddy", "gemini", "/bin/sh", "/bin/bash", "sh", "bash"];
+export type TrustedAgent = typeof TRUSTED_AGENTS[number];
+export declare function isTrustedAgent(command: string): command is TrustedAgent;

package/dist/terminal/types.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Terminal Sidecar Types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRUSTED_AGENTS = void 0;
+exports.isTrustedAgent = isTrustedAgent;
+// Trusted agents whitelist
+exports.TRUSTED_AGENTS = [
+    'claude', 'codex', 'aider', 'codebuddy', 'gemini',
+    '/bin/sh', '/bin/bash', 'sh', 'bash',
+];
+function isTrustedAgent(command) {
+    return exports.TRUSTED_AGENTS.includes(command);
+}
+//# sourceMappingURL=types.js.map

package/dist/terminal/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/terminal/types.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AA+FH,wCAEC;AATD,2BAA2B;AACd,QAAA,cAAc,GAAG;IAC5B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ;IACjD,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM;CAC5B,CAAC;AAGX,SAAgB,cAAc,CAAC,OAAe;IAC5C,OAAO,sBAAc,CAAC,QAAQ,CAAC,OAAuB,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * Terminal Sidecar Types\n */\n\nexport type SessionStatus = 'active' | 'idle' | 'terminated';\n\nexport interface TerminalPermissions {\n  /** Allowed working directories */\n  allowedWorkdirs: string[];\n  /** Secrets to inject as environment variables */\n  injectSecrets: string[];\n  /** Maximum session duration in seconds */\n  maxSessionDuration: number;\n  /** Network access domains (for bubblewrap) */\n  networkAccess?: string[];\n}\n\nexport interface SessionConfig {\n  /** Command to execute (must be in TRUSTED_AGENTS) */\n  command: string;\n  /** Command arguments */\n  args: string[];\n  /** Working directory */\n  workdir: string;\n  /** Environment variables to inject */\n  env: Record<string, string | EnvRef>;\n  /** Session timeout in seconds */\n  timeout: number;\n}\n\nexport interface EnvRef {\n  '@ref': string;\n  jsonPath: string;\n}\n\nexport interface Session {\n  sessionId: string;\n  userId: string;\n  command: string;\n  workdir: string;\n  status: SessionStatus;\n  createdAt: Date;\n  expiresAt: Date;\n  ptyPid?: number;\n}\n\nexport interface CreateSessionRequest {\n  command: string;\n  args?: string[];\n  workdir?: string;\n  env?: Record<string, string | EnvRef>;\n  timeout?: number;\n}\n\nexport interface CreateSessionResponse {\n  sessionId: string;\n  status: SessionStatus;\n  wsUrl: string;\n  createdAt: string;\n  expiresAt: string;\n}\n\n// WebSocket message types\n\nexport type ClientMessageType = 'input' | 'resize' | 'signal' | 'ping' | 'permission_response';\nexport type ServerMessageType = 'output' | 'exit' | 'error' | 'pong' | 'permission_request';\n\nexport interface ClientMessage {\n  type: ClientMessageType;\n  data?: string;\n  cols?: number;\n  rows?: number;\n  signal?: string;\n  requestId?: string;\n  granted?: boolean;\n}\n\nexport interface ServerMessage {\n  type: ServerMessageType;\n  data?: string;\n  code?: number | string;\n  signal?: string;\n  message?: string;\n  requestId?: string;\n  description?: string;\n  action?: string;\n  resource?: string;\n  timeout?: number;\n}\n\n// Trusted agents whitelist\nexport const TRUSTED_AGENTS = [\n  'claude', 'codex', 'aider', 'codebuddy', 'gemini',\n  '/bin/sh', '/bin/bash', 'sh', 'bash',\n] as const;\nexport type TrustedAgent = typeof TRUSTED_AGENTS[number];\n\nexport function isTrustedAgent(command: string): command is TrustedAgent {\n  return TRUSTED_AGENTS.includes(command as TrustedAgent);\n}\n"]}

package/dist/tunnel/CloudflareTunnelProvider.d.ts

@@ -0,0 +1,120 @@
+import type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus } from './TunnelProvider';
+/**
+ * Cloudflare Tunnel Provider 配置
+ */
+export interface CloudflareTunnelProviderOptions {
+    /** Cloudflare API Token (需要 Tunnel 和 DNS 权限) */
+    apiToken: string;
+    /** Cloudflare Account ID */
+    accountId: string;
+    /** 基础域名 (如 pods.undefieds.co) */
+    baseDomain: string;
+    /** cloudflared 可执行文件路径 (默认 'cloudflared') */
+    cloudflaredPath?: string;
+}
+/**
+ * Cloudflare Tunnel Provider
+ *
+ * 使用 Cloudflare Tunnel 实现隧道穿透
+ */
+export declare class CloudflareTunnelProvider implements TunnelProvider {
+    readonly name = "cloudflare";
+    private readonly apiToken;
+    private readonly accountId;
+    private readonly baseDomain;
+    private readonly cloudflaredPath;
+    private process;
+    private status;
+    private currentConfig;
+    /** 标记隧道进程是否由我们启动和管理 */
+    private managedByUs;
+    constructor(options: CloudflareTunnelProviderOptions);
+    /**
+     * 初始化隧道
+     */
+    setup(options: TunnelSetupOptions): Promise<TunnelConfig>;
+    /**
+     * 启动隧道客户端
+     * 如果 cloudflared 已经在运行，则跳过启动
+     */
+    start(config: TunnelConfig): Promise<void>;
+    /**
+     * 停止隧道
+     * 只有当隧道是由我们启动时才会停止
+     */
+    stop(): Promise<void>;
+    /**
+     * 获取隧道状态
+     */
+    getStatus(): TunnelStatus;
+    /**
+     * 获取公网端点
+     */
+    getEndpoint(): string | undefined;
+    /**
+     * 清理资源
+     */
+    cleanup(config: TunnelConfig): Promise<void>;
+    /**
+     * 创建 Tunnel
+     */
+    private createTunnel;
+    /**
+     * 配置 Tunnel Ingress
+     */
+    private configureTunnelIngress;
+    /**
+     * 获取 Tunnel Token
+     */
+    private getTunnelToken;
+    /**
+     * 删除 Tunnel
+     */
+    private deleteTunnel;
+    /**
+     * 创建 DNS CNAME 记录
+     */
+    private createDnsRecord;
+    /**
+     * 删除 DNS 记录
+     */
+    private deleteDnsRecord;
+    /**
+     * 获取 Zone ID
+     */
+    private getZoneId;
+    /**
+     * Cloudflare API 请求
+     */
+    private cloudflareApi;
+    /**
+     * 生成 Tunnel Secret
+     */
+    private generateTunnelSecret;
+    /**
+     * 等待连接建立
+     */
+    private waitForConnection;
+    /**
+     * 检测 cloudflared 是否已经在运行
+     * 通过进程检测 + metrics 端口检测
+     */
+    isCloudflaredRunning(): Promise<boolean>;
+    /**
+     * 检测 cloudflared 进程是否存在
+     */
+    private isCloudflaredProcessRunning;
+    /**
+     * 检测 cloudflared metrics 端口是否开放
+     */
+    private isMetricsPortOpen;
+    /**
+     * 检测隧道是否可从外部访问
+     * @param domain 要检测的域名
+     */
+    isReachable(domain: string): Promise<boolean>;
+    /**
+     * 获取是否由我们管理
+     */
+    isManagedByUs(): boolean;
+}