@xopcai/xopc 0.0.270 → 0.0.273

package/dist/src/tunnel/frpc-binary.js

@@ -2,127 +2,115 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBinDir } from "../config/paths.js";
 import { extractFrpcFromReleaseArchive, frpcReleaseArchiveExtension, nodePlatformForFrpTarget } from "./frpc-extract.js";
-import { tmpdir } from "node:os";
+import { FRPC_RELEASES, FRPC_VERSION } from "./frpc-release.js";
 import { join } from "node:path";
-import { chmodSync, createWriteStream, existsSync, mkdirSync, rmSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { chmodSync, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { pipeline } from "node:stream/promises";
-import { Readable } from "node:stream";
+import { Readable, Transform } from "node:stream";
 //#region src/tunnel/frpc-binary.ts
 init_paths();
 init_logger();
 const log = createLogger("TunnelFrpc");
-const FRPC_VERSION = "0.62.1";
-const PLATFORM_MAP = {
-	darwin: "darwin",
-	linux: "linux",
-	win32: "windows"
-};
-const ARCH_MAP = {
-	x64: "amd64",
-	arm64: "arm64",
-	ia32: "386"
-};
-function buildFrpcReleaseBasename(frpPlatform, arch, version = FRPC_VERSION) {
-	return `frp_${version}_${frpPlatform}_${arch}`;
+const MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+function buildFrpcReleaseBasename(platform, arch, version = FRPC_VERSION) {
+	return `frp_${version}_${platform}_${arch}`;
 }
-function frpcDownloadUrlsForTarget(frpPlatform, arch, version = FRPC_VERSION) {
-	const folder = buildFrpcReleaseBasename(frpPlatform, arch, version);
-	const ext = frpcReleaseArchiveExtension(frpPlatform);
-	return [
-		`https://frp.xopc.ai/bin/${folder}${ext}`,
-		`https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`,
-		`https://ghfast.top/https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`
-	];
+function frpcDownloadUrlsForTarget(platform, arch, version = FRPC_VERSION) {
+	const archive = buildFrpcReleaseBasename(platform, arch, version) + frpcReleaseArchiveExtension(platform);
+	return [`https://frp.xopc.ai/bin/${archive}`, `https://github.com/fatedier/frp/releases/download/v${version}/${archive}`];
 }
-function frpcPlatformArch() {
-	const platform = PLATFORM_MAP[process.platform] ?? process.platform;
-	const arch = ARCH_MAP[process.arch] ?? process.arch;
-	return {
-		platform,
-		arch,
-		folder: buildFrpcReleaseBasename(platform, arch)
-	};
+async function verifyFrpcDigest(path, expected) {
+	const hash = createHash("sha256");
+	await pipeline(createReadStream(path), hash);
+	if (hash.digest("hex") !== expected) throw new Error("COMPONENT_VERIFY_FAILED: frpc checksum mismatch");
 }
-function frpcDownloadUrls() {
-	const { platform, arch } = frpcPlatformArch();
-	return frpcDownloadUrlsForTarget(platform, arch);
-}
-async function downloadToFile(url, destPath, onProgress) {
-	const res = await fetch(url);
-	if (!res.ok || !res.body) throw new Error(`Download failed: ${res.status} ${url}`);
-	const contentLength = res.headers.get("content-length");
-	const totalBytes = contentLength && Number.isFinite(Number(contentLength)) ? Number(contentLength) : null;
+async function downloadToFile(url, path, onProgress) {
+	const response = await fetch(url, { signal: AbortSignal.timeout(6e4) });
+	if (!response.ok || !response.body) throw new Error(`frpc download failed: ${response.status}`);
+	const length = Number(response.headers.get("content-length"));
+	const totalBytes = length > 0 ? length : null;
+	if (totalBytes && totalBytes > MAX_ARCHIVE_BYTES) {
+		await response.body.cancel();
+		throw new Error("frpc archive exceeds size limit");
+	}
 	let bytesReceived = 0;
-	const report = () => {
+	const bounded = new Transform({ transform(chunk, _encoding, callback) {
+		bytesReceived += chunk.length;
+		if (bytesReceived > MAX_ARCHIVE_BYTES) return callback(/* @__PURE__ */ new Error("frpc archive exceeds size limit"));
 		onProgress?.({
 			phase: "downloading",
 			url,
 			bytesReceived,
 			totalBytes,
-			percent: totalBytes && totalBytes > 0 ? Math.min(100, Math.round(bytesReceived / totalBytes * 100)) : null
+			percent: totalBytes ? Math.min(100, Math.round(bytesReceived / totalBytes * 100)) : null
 		});
-	};
-	report();
-	const nodeStream = Readable.fromWeb(res.body);
-	nodeStream.on("data", (chunk) => {
-		bytesReceived += typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.length;
-		report();
-	});
-	await pipeline(nodeStream, createWriteStream(destPath));
-	report();
+		callback(null, chunk);
+	} });
+	await pipeline(Readable.fromWeb(response.body), bounded, createWriteStream(path, { mode: 384 }));
 }
-/** Set after a successful tunnel start so subprocesses can resolve the same binary. */
-function publishFrpcPathForProcess(binPath) {
-	process.env.XOPC_FRPC_PATH = binPath;
+function publishFrpcPathForProcess(path) {
+	process.env.XOPC_FRPC_PATH = path;
 }
-/** Clear runtime frpc path when the tunnel stops (no bundled Electron binary). */
 function clearFrpcPathForProcess() {
 	delete process.env.XOPC_FRPC_PATH;
 }
-async function ensureFrpcBinary(opts) {
-	const onProgress = opts?.onProgress;
-	const binName = `frpc${process.platform === "win32" ? ".exe" : ""}`;
-	const fromEnv = process.env.XOPC_FRPC_PATH?.trim();
-	if (fromEnv && existsSync(fromEnv)) return fromEnv;
-	const cacheDir = resolveBinDir();
-	mkdirSync(cacheDir, { recursive: true });
+async function ensureFrpcBinary(opts = {}) {
+	const platform = opts.platform ?? (process.platform === "win32" ? "windows" : process.platform);
+	const arch = opts.arch ?? (process.arch === "x64" ? "amd64" : process.arch);
+	const target = `${platform}_${arch}`;
+	if (!Object.hasOwn(FRPC_RELEASES, target)) throw new Error(`Unsupported frpc target: ${target}`);
+	const release = FRPC_RELEASES[target];
+	const fromEnv = !opts.platform && !opts.arch ? process.env.XOPC_FRPC_PATH?.trim() : void 0;
+	if (fromEnv) {
+		await verifyFrpcDigest(fromEnv, release.binary);
+		return fromEnv;
+	}
+	const cacheDir = join(resolveBinDir(), "frpc", FRPC_VERSION, target);
+	mkdirSync(cacheDir, {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(cacheDir, 448);
+	const binName = platform === "windows" ? "frpc.exe" : "frpc";
 	const cachePath = join(cacheDir, binName);
-	if (existsSync(cachePath)) return cachePath;
-	const tmpBase = join(tmpdir(), `xopc-frpc-${randomBytes(6).toString("hex")}`);
-	mkdirSync(tmpBase, { recursive: true });
-	const { platform, arch, folder } = frpcPlatformArch();
-	const archivePath = join(tmpBase, `frpc${frpcReleaseArchiveExtension(platform)}`);
-	const urls = frpcDownloadUrls();
-	let lastErr;
+	if (existsSync(cachePath)) try {
+		await verifyFrpcDigest(cachePath, release.binary);
+		return cachePath;
+	} catch {
+		log.warn({ target }, "Discarding unverified frpc cache");
+	}
+	const temporary = mkdtempSync(join(cacheDir, ".download-"));
+	const archivePath = join(temporary, "release" + frpcReleaseArchiveExtension(platform));
+	const executablePath = join(temporary, binName);
+	let lastError;
 	try {
-		for (const url of urls) try {
-			log.info({ url }, "Downloading frpc");
-			await downloadToFile(url, archivePath, onProgress);
-			onProgress?.({
+		for (const url of frpcDownloadUrlsForTarget(platform, arch)) try {
+			await downloadToFile(url, archivePath, opts.onProgress);
+			await verifyFrpcDigest(archivePath, release.archive);
+			opts.onProgress?.({
 				phase: "extracting",
-				url,
-				bytesReceived: 0,
-				totalBytes: null,
-				percent: null
+				url
 			});
-			await extractFrpcFromReleaseArchive(archivePath, cachePath, folder, nodePlatformForFrpTarget(platform));
-			if (process.platform !== "win32") chmodSync(cachePath, 493);
+			await extractFrpcFromReleaseArchive(archivePath, executablePath, buildFrpcReleaseBasename(platform, arch), nodePlatformForFrpTarget(platform));
+			await verifyFrpcDigest(executablePath, release.binary);
+			if (platform !== "windows") chmodSync(executablePath, 448);
+			renameSync(executablePath, cachePath);
 			return cachePath;
-		} catch (err) {
-			lastErr = err;
+		} catch (error) {
+			lastError = error;
 			log.warn({
 				url,
-				err
-			}, "frpc download attempt failed");
+				err: error
+			}, "Verified frpc download failed");
 		}
 	} finally {
-		rmSync(tmpBase, {
+		rmSync(temporary, {
 			recursive: true,
 			force: true
 		});
 	}
-	throw new Error(`Failed to download frpc v${FRPC_VERSION} for ${platform}/${arch}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+	throw new Error(`Failed to obtain verified frpc for ${target}`, { cause: lastError });
 }
 //#endregion
-export { FRPC_VERSION, buildFrpcReleaseBasename, clearFrpcPathForProcess, ensureFrpcBinary, frpcDownloadUrlsForTarget, publishFrpcPathForProcess };
+export { FRPC_VERSION, buildFrpcReleaseBasename, clearFrpcPathForProcess, ensureFrpcBinary, frpcDownloadUrlsForTarget, publishFrpcPathForProcess, verifyFrpcDigest };

package/dist/src/tunnel/frpc-config.d.ts

@@ -1,3 +1,4 @@
 import type { TunnelRegistration } from './tunnel-types.js';
 export declare function resolveFrpcConfigPath(tunnelId: string): string;
-export declare function writeFrpcConfig(registration: TunnelRegistration, localPort: number, localHost?: string, mode?: 'http' | 'https'): string;
+export declare function removeFrpcConfig(tunnelId: string): void;
+export declare function writeFrpcConfig(registration: TunnelRegistration, localPort: number, localHost?: string): string;

package/dist/src/tunnel/frpc-config.js

@@ -1,34 +1,51 @@
 import { resolveStateDir } from "../config/paths-state.js";
 import { init_paths } from "../config/paths.js";
 import { join } from "node:path";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { rootCertificates } from "node:tls";
 //#region src/tunnel/frpc-config.ts
 init_paths();
 function resolveFrpcConfigPath(tunnelId) {
+	if (!/^[a-zA-Z0-9_-]+$/.test(tunnelId)) throw new Error("Invalid tunnel id");
 	const tmpDir = join(resolveStateDir(), "tmp");
-	mkdirSync(tmpDir, { recursive: true });
+	mkdirSync(tmpDir, {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(tmpDir, 448);
 	return join(tmpDir, `frpc-${tunnelId}.toml`);
 }
-function writeFrpcConfig(registration, localPort, localHost = "127.0.0.1", mode = "http") {
+function removeFrpcConfig(tunnelId) {
+	rmSync(resolveFrpcConfigPath(tunnelId), { force: true });
+}
+function writeFrpcConfig(registration, localPort, localHost = "127.0.0.1") {
 	const configPath = resolveFrpcConfigPath(registration.tunnelId);
+	const caPath = join(resolveStateDir(), "tmp", "frp-trusted-roots.pem");
+	writeFileSync(caPath, rootCertificates.join("\n"), { mode: 384 });
 	const { frpc } = registration;
+	for (const port of [localPort, frpc.serverPort]) if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid tunnel port");
+	const quote = JSON.stringify;
 	writeFileSync(configPath, `# Auto-generated by xopc — do not edit
-serverAddr = "${frpc.serverAddr}"
+serverAddr = ${quote(frpc.serverAddr)}
 serverPort = ${frpc.serverPort}
-metadatas.token = "${frpc.authToken}"
-
+metadatas.token = ${quote(frpc.authToken)}
 loginFailExit = false
+transport.tls.enable = true
+transport.tls.serverName = ${quote(frpc.serverAddr)}
+transport.tls.trustedCaFile = ${quote(caPath)}
 transport.heartbeatInterval = 10
 transport.heartbeatTimeout = 30
 
 [[proxies]]
-name = "${frpc.proxyName}"
-type = "${mode}"
-localIP = "${localHost}"
+name = ${quote(frpc.proxyName)}
+type = "http"
+localIP = ${quote(localHost)}
 localPort = ${localPort}
-subdomain = "${registration.subdomain}"
-`, "utf8");
+subdomain = ${quote(frpc.subdomain)}
+hostHeaderRewrite = ${quote(new URL(registration.publicUrl).hostname)}
+`, { mode: 384 });
+	chmodSync(configPath, 384);
 	return configPath;
 }
 //#endregion
-export { resolveFrpcConfigPath, writeFrpcConfig };
+export { removeFrpcConfig, resolveFrpcConfigPath, writeFrpcConfig };

package/dist/src/tunnel/frpc-release.d.ts

@@ -0,0 +1,27 @@
+export declare const FRPC_VERSION = "0.62.1";
+export declare const FRPC_RELEASES: {
+    readonly darwin_amd64: {
+        readonly archive: "f951a5aa727a4880f32753ba3c41ecc9dee38a63658760354011e71ea83db995";
+        readonly binary: "5ce5258b6ff1a232e9eb8e29247a55badb127e7fc66b5a58c299b442aba2bcb2";
+    };
+    readonly darwin_arm64: {
+        readonly archive: "f9fc616d994a87d790504da21c2f942cd4224637d9ade9a67482f3c23c7f2432";
+        readonly binary: "49afde483f55927c3eeac9141cae82857cb2f15b9e9d55f4ac45378e761eabcc";
+    };
+    readonly linux_amd64: {
+        readonly archive: "dcf1c62e5862543b6686a8e4c2f430ef636ac33306167f377e7272875020c4d3";
+        readonly binary: "030bff369048a49fce09e44f96e71fab36522394675ab10b2e684c9e3cc0aa26";
+    };
+    readonly linux_arm64: {
+        readonly archive: "94c98c19ce181f8e09e0d0cb79c278c31e9ec936eb713826a1ddf4995e7c2155";
+        readonly binary: "3f900ac9b035aac50b117ce5f7c450ca073d3e453448783979e978dc57bc39a9";
+    };
+    readonly windows_amd64: {
+        readonly archive: "a12e3b36b81232ad9888b43519a6dbcacc5c8def52f3a6c6e95d4fae6a373c5d";
+        readonly binary: "14cd52ca87fea607852b3a8e194146eeabe6ce87976cd1fc6327b74caebb6c77";
+    };
+    readonly windows_arm64: {
+        readonly archive: "da9e79e7cacc5570631196fae2f9e50ae5202521aa8abaf2e6de85b1778086b9";
+        readonly binary: "14b1b4bdd75228dc29dbc3ca264602911242a0e60cb0acb3311eb4926d50cb4b";
+    };
+};

package/dist/src/tunnel/frpc-release.js

@@ -0,0 +1,30 @@
+//#region src/tunnel/frpc-release.ts
+const FRPC_VERSION = "0.62.1";
+const FRPC_RELEASES = {
+	"darwin_amd64": {
+		"archive": "f951a5aa727a4880f32753ba3c41ecc9dee38a63658760354011e71ea83db995",
+		"binary": "5ce5258b6ff1a232e9eb8e29247a55badb127e7fc66b5a58c299b442aba2bcb2"
+	},
+	"darwin_arm64": {
+		"archive": "f9fc616d994a87d790504da21c2f942cd4224637d9ade9a67482f3c23c7f2432",
+		"binary": "49afde483f55927c3eeac9141cae82857cb2f15b9e9d55f4ac45378e761eabcc"
+	},
+	"linux_amd64": {
+		"archive": "dcf1c62e5862543b6686a8e4c2f430ef636ac33306167f377e7272875020c4d3",
+		"binary": "030bff369048a49fce09e44f96e71fab36522394675ab10b2e684c9e3cc0aa26"
+	},
+	"linux_arm64": {
+		"archive": "94c98c19ce181f8e09e0d0cb79c278c31e9ec936eb713826a1ddf4995e7c2155",
+		"binary": "3f900ac9b035aac50b117ce5f7c450ca073d3e453448783979e978dc57bc39a9"
+	},
+	"windows_amd64": {
+		"archive": "a12e3b36b81232ad9888b43519a6dbcacc5c8def52f3a6c6e95d4fae6a373c5d",
+		"binary": "14cd52ca87fea607852b3a8e194146eeabe6ce87976cd1fc6327b74caebb6c77"
+	},
+	"windows_arm64": {
+		"archive": "da9e79e7cacc5570631196fae2f9e50ae5202521aa8abaf2e6de85b1778086b9",
+		"binary": "14b1b4bdd75228dc29dbc3ca264602911242a0e60cb0acb3311eb4926d50cb4b"
+	}
+};
+//#endregion
+export { FRPC_RELEASES, FRPC_VERSION };

package/dist/src/tunnel/gateway-lifecycle.js

@@ -3,6 +3,8 @@ import { init_logger } from "../utils/logger.js";
 import { resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
 import { resolveOptionalTunnelRegistrationSecret, resolveTunnelBrokerUrl } from "./env.js";
 import { getTunnelService } from "./tunnel-service.js";
+import { resolveGatewayAuth } from "../gateway/auth.js";
+import { requireTunnelGatewayToken } from "./auth-policy.js";
 import { hasValidTunnelConsent } from "./consent.js";
 import { resolveFrpSubdomainHost } from "./frp-subdomain-host.js";
 import { fetchTunnelWellKnown } from "./well-known.js";
@@ -99,7 +101,8 @@ async function maybeAutoStartTunnelFromConfig(config, gatewayToken) {
 	const port = (config.gateway ?? {}).port ?? 18790;
 	const host = resolveGatewayEffectiveHost(config);
 	await configureTunnelFromGatewayConfig(config);
-	if (!gatewayToken) {
+	const resolvedAuth = resolveGatewayAuth({ authConfig: config.gateway?.auth });
+	if (resolvedAuth.mode !== "token" || !gatewayToken?.trim()) {
 		log.warn({ phase: "tunnel_autostart" }, "tunnel.autoStart is enabled but gateway auth token is unavailable (auth mode may be none)");
 		return;
 	}
@@ -113,7 +116,10 @@ async function maybeAutoStartTunnelFromConfig(config, gatewayToken) {
 		return;
 	}
 	try {
-		await tunnel.start(port, gatewayToken);
+		await tunnel.start(port, requireTunnelGatewayToken({
+			mode: resolvedAuth.mode,
+			token: gatewayToken
+		}));
 		log.info({
 			phase: "tunnel_autostart",
 			host,

package/dist/src/tunnel/index.js

@@ -1,5 +1,6 @@
 import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
-import { FRPC_VERSION, clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
+import { FRPC_VERSION } from "./frpc-release.js";
+import { clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, isLocalDevelopmentTunnelBroker, isMaskedTunnelSecretPatchValue, resolveOptionalTunnelRegistrationSecret, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, tunnelRegistrationSecretRequiredMessage } from "./env.js";
 import { loadTunnelState, resolveTunnelStatePath, saveTunnelState } from "./tunnel-state.js";
 import { logTunnelAudit } from "./tunnel-audit.js";

package/dist/src/tunnel/registration-proof.d.ts

@@ -0,0 +1,19 @@
+/** Canonical v2 registration proof, shared with the Broker protocol test vectors. */
+export declare function createTunnelRegistrationProof(input: {
+    brokerUrl: string;
+    platform: string;
+    gatewayVersion: string;
+    preferredSubdomain?: string;
+    recoveryToken?: string;
+}): {
+    version: number;
+    gatewayId: string;
+    publicKey: string;
+    platform: string;
+    gatewayVersion: string;
+    preferredSubdomain: string;
+    recoveryToken: string;
+    nonce: string;
+    expiresAt: number;
+    signature: string;
+};

package/dist/src/tunnel/registration-proof.js

@@ -0,0 +1,37 @@
+import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../storage/sqlite/gateway-identity-repository.js";
+import { randomBytes } from "node:crypto";
+//#region src/tunnel/registration-proof.ts
+/** Canonical v2 registration proof, shared with the Broker protocol test vectors. */
+function createTunnelRegistrationProof(input) {
+	const identity = getOrCreateGatewayIdentity();
+	const publicKey = getGatewayIdentityPublicKeyRaw(identity);
+	const nonce = randomBytes(24).toString("base64url");
+	const expiresAt = Date.now() + 12e4;
+	const audience = input.brokerUrl.replace(/\/+$/, "");
+	const payload = JSON.stringify([
+		"xopc-tunnel-registration-v2",
+		audience,
+		identity.id,
+		publicKey,
+		input.platform,
+		input.gatewayVersion,
+		input.preferredSubdomain ?? "",
+		input.recoveryToken ?? "",
+		nonce,
+		expiresAt
+	]);
+	return {
+		version: 2,
+		gatewayId: identity.id,
+		publicKey,
+		platform: input.platform,
+		gatewayVersion: input.gatewayVersion,
+		preferredSubdomain: input.preferredSubdomain,
+		recoveryToken: input.recoveryToken,
+		nonce,
+		expiresAt,
+		signature: signGatewayPayload(payload)
+	};
+}
+//#endregion
+export { createTunnelRegistrationProof };

package/dist/src/tunnel/tunnel-persist.js

@@ -8,6 +8,7 @@ function persistedFromRegistration(registration) {
 		frpcAuthToken: registration.frpc.authToken,
 		registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
 		enabled: true,
+		frpcSubdomain: registration.frpc.subdomain,
 		frpcServerAddr: registration.frpc.serverAddr,
 		frpcServerPort: registration.frpc.serverPort,
 		proxyName: registration.frpc.proxyName,
@@ -16,13 +17,14 @@ function persistedFromRegistration(registration) {
 }
 /** Rebuild registration from disk when Broker row is still valid (stop without deregister). */
 function registrationFromPersisted(persisted) {
-	if (!persisted.frpcAuthToken || !persisted.frpcServerAddr || !persisted.frpcServerPort || !persisted.proxyName) return null;
+	if (!persisted.frpcSubdomain || !persisted.frpcAuthToken || !persisted.frpcServerAddr || !persisted.frpcServerPort || !persisted.proxyName) return null;
 	return {
 		tunnelId: persisted.tunnelId,
 		tunnelToken: persisted.tunnelToken,
 		subdomain: persisted.subdomain,
 		publicUrl: persisted.publicUrl,
 		frpc: {
+			subdomain: persisted.frpcSubdomain,
 			serverAddr: persisted.frpcServerAddr,
 			serverPort: persisted.frpcServerPort,
 			authToken: persisted.frpcAuthToken,

package/dist/src/tunnel/tunnel-service.d.ts

@@ -37,6 +37,7 @@ export declare class TunnelService extends EventEmitter {
     private spawnAndWait;
     private scheduleReconnect;
     private runReconnectLoop;
+    private heartbeatGeneration;
     private startHeartbeat;
     private clearHeartbeat;
 }

package/dist/src/tunnel/tunnel-service.js

@@ -1,9 +1,9 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
+import { TunnelBrokerClient, TunnelBrokerError, resolveBrokerApiBase } from "./broker-client.js";
 import { clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
-import { writeFrpcConfig } from "./frpc-config.js";
+import { removeFrpcConfig, writeFrpcConfig } from "./frpc-config.js";
 import { spawnFrpcProcess } from "./frpc-process.js";
 import { TunnelRegistrationSecretError } from "./env.js";
 import { canResumePersistedTunnel, persistedFromRegistration, registrationFromPersisted } from "./tunnel-persist.js";
@@ -127,7 +127,7 @@ var TunnelService = class extends EventEmitter {
 		saveTunnelState(state);
 		this.setStartPhase("registering", { publicUrl: registration.publicUrl });
 		try {
-			const configPath = writeFrpcConfig(registration, gatewayPort, "127.0.0.1", "http");
+			const configPath = writeFrpcConfig(registration, gatewayPort, "127.0.0.1");
 			this.setStartPhase("starting_frpc", { publicUrl: registration.publicUrl });
 			await this.spawnAndWait(frpcBin, configPath, broker, state, registration.heartbeatIntervalMs);
 		} catch (err) {
@@ -161,6 +161,7 @@ var TunnelService = class extends EventEmitter {
 		let released = false;
 		const persisted = loadTunnelState();
 		const cfg = this.serviceConfig;
+		if (persisted) removeFrpcConfig(persisted.tunnelId);
 		if (release && persisted && cfg) {
 			const broker = new TunnelBrokerClient(resolveBrokerApiBase(cfg.brokerUrl));
 			try {
@@ -206,6 +207,7 @@ var TunnelService = class extends EventEmitter {
 				return resumed;
 			}
 		} catch (err) {
+			if (!(err instanceof TunnelBrokerError) || err.status !== 410) throw err;
 			log.info({
 				err,
 				tunnelId: persisted.tunnelId,
@@ -218,7 +220,7 @@ var TunnelService = class extends EventEmitter {
 			registrationSecret: cfg.registrationSecret,
 			gatewayVersion: PACKAGE_VERSION,
 			platform: platformLabel(),
-			gatewayTokenHash: hashGatewayToken(gatewayToken),
+			recoveryToken: persisted?.tunnelToken,
 			preferredSubdomain: persisted?.subdomain
 		});
 	}
@@ -285,19 +287,37 @@ var TunnelService = class extends EventEmitter {
 			}
 		}
 	}
+	heartbeatGeneration = 0;
 	startHeartbeat(broker, state, intervalMs) {
 		this.clearHeartbeat();
+		const generation = this.heartbeatGeneration;
+		let pending = false;
 		const tick = async () => {
+			if (pending || this.stopping || generation !== this.heartbeatGeneration) return;
+			pending = true;
 			try {
 				await broker.heartbeat(state.tunnelId, state.tunnelToken);
-				this.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+				if (generation === this.heartbeatGeneration) this.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
 			} catch (err) {
 				log.warn({
 					err,
 					tunnelId: state.tunnelId
 				}, "Tunnel heartbeat failed");
-				if (this.stopping) return;
+				if (this.stopping || generation !== this.heartbeatGeneration) return;
+				if (!(err instanceof TunnelBrokerError) || ![
+					401,
+					403,
+					410
+				].includes(err.status)) return;
 				this.clearHeartbeat();
+				if (err.status === 401 || err.status === 403) {
+					await this.stop();
+					this.lastError = "TUNNEL_AUTH_REVOKED";
+					this.state = "error";
+					this.emit("tunnel:error", this.lastError);
+					return;
+				}
+				const renewalGeneration = this.heartbeatGeneration;
 				const ctx = this.startContext;
 				const cfg = this.serviceConfig;
 				if (!ctx || !cfg) return;
@@ -308,25 +328,32 @@ var TunnelService = class extends EventEmitter {
 						registrationSecret: cfg.registrationSecret,
 						gatewayVersion: PACKAGE_VERSION,
 						platform: platformLabel(),
-						gatewayTokenHash: hashGatewayToken(ctx.gatewayToken),
+						recoveryToken: state.tunnelToken,
 						preferredSubdomain: state.subdomain
 					});
+					if (this.stopping || renewalGeneration !== this.heartbeatGeneration) return;
 					const next = persistedFromRegistration(registration);
+					removeFrpcConfig(state.tunnelId);
 					saveTunnelState(next);
 					const frpcBin = await ensureFrpcBinary();
-					const configPath = writeFrpcConfig(registration, ctx.gatewayPort, "127.0.0.1", "http");
+					const configPath = writeFrpcConfig(registration, ctx.gatewayPort, "127.0.0.1");
 					await this.spawnAndWait(frpcBin, configPath, broker, next, registration.heartbeatIntervalMs);
 				} catch (reErr) {
+					if (this.stopping || renewalGeneration !== this.heartbeatGeneration) return;
+					if (reErr instanceof TunnelBrokerError && [401, 403].includes(reErr.status)) await this.stop();
 					this.lastError = reErr instanceof Error ? reErr.message : String(reErr);
 					this.state = "error";
 					this.emit("tunnel:error", this.lastError);
 				}
+			} finally {
+				pending = false;
 			}
 		};
 		tick();
 		this.heartbeatTimer = setInterval(() => void tick(), intervalMs);
 	}
 	clearHeartbeat() {
+		this.heartbeatGeneration += 1;
 		if (this.heartbeatTimer) {
 			clearInterval(this.heartbeatTimer);
 			this.heartbeatTimer = null;

package/dist/src/tunnel/tunnel-state.js

@@ -1,7 +1,7 @@
 import { resolveStateDir } from "../config/paths-state.js";
 import { init_paths } from "../config/paths.js";
 import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 //#region src/tunnel/tunnel-state.ts
 init_paths();
 const TUNNEL_STATE_FILE = "tunnel.json";
@@ -22,8 +22,15 @@ function loadTunnelState() {
 }
 function saveTunnelState(state) {
 	const path = resolveTunnelStatePath();
-	mkdirSync(resolveStateDir(), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+	mkdirSync(resolveStateDir(), {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(resolveStateDir(), 448);
+	const temporary = `${path}.${process.pid}.tmp`;
+	writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { mode: 384 });
+	chmodSync(temporary, 384);
+	renameSync(temporary, path);
 }
 function updateTunnelState(patch) {
 	const current = loadTunnelState();
@@ -36,8 +43,7 @@ function updateTunnelState(patch) {
 	return next;
 }
 function clearTunnelState() {
-	const path = resolveTunnelStatePath();
-	if (existsSync(path)) writeFileSync(path, "{}\n", "utf8");
+	rmSync(resolveTunnelStatePath(), { force: true });
 }
 //#endregion
 export { clearTunnelState, loadTunnelState, resolveTunnelStatePath, saveTunnelState, updateTunnelState };

package/dist/src/tunnel/tunnel-types.d.ts

@@ -21,6 +21,7 @@ export type TunnelRegistration = {
         serverPort: number;
         authToken: string;
         proxyName: string;
+        subdomain: string;
     };
     expiresAt: string;
     heartbeatIntervalMs: number;
@@ -34,6 +35,7 @@ export type PersistedTunnelState = {
     registeredAt: string;
     enabled?: boolean;
     /** Saved on register so stop/start can resume without re-registering. */
+    frpcSubdomain?: string;
     frpcServerAddr?: string;
     frpcServerPort?: number;
     proxyName?: string;