@yoooclaw/phone-notifications 1.7.1 → 1.7.3

package/dist/index.js

@@ -5495,6 +5495,16 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // src/tunnel/relay-client.ts
+function previewText(text, max = 500) {
+  return text.length <= max ? text : `${text.substring(0, max)}\u2026`;
+}
+function maskSecret(value) {
+  if (!value) return "empty";
+  if (value.length <= 8) {
+    return `${value.slice(0, 2)}\u2026${value.slice(-2)}`;
+  }
+  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
 var RelayClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -5575,8 +5585,9 @@ var RelayClient = class {
   async connect() {
     if (this.aborted) return;
     this.cleanup(true);
+    const rawApiKey = this.opts.apiKey.startsWith("Bearer ") ? this.opts.apiKey.slice("Bearer ".length) : this.opts.apiKey;
     this.opts.logger.info(
-      `Relay tunnel: connecting to ${this.opts.tunnelUrl} (attempt=${this.reconnectAttempt}, heartbeat=${this.opts.heartbeatSec}s)`
+      `Relay tunnel: connecting to ${this.opts.tunnelUrl} (attempt=${this.reconnectAttempt}, heartbeat=${this.opts.heartbeatSec}s, apiKey=${maskSecret(rawApiKey)})`
     );
     this.writeStatus("connecting");
     return new Promise((resolve) => {
@@ -5587,7 +5598,6 @@ var RelayClient = class {
           resolve();
         }
       };
-      const rawApiKey = this.opts.apiKey.startsWith("Bearer ") ? this.opts.apiKey.slice("Bearer ".length) : this.opts.apiKey;
       const wsUrl = new URL(this.opts.tunnelUrl);
       if (!wsUrl.searchParams.get("apiKey")) {
         wsUrl.searchParams.set("apiKey", rawApiKey);
@@ -5631,8 +5641,9 @@ var RelayClient = class {
       });
       ws.on("close", (code, reason) => {
         const reasonStr = reason.toString();
+        const lastInboundAgoMs = this.lastInboundAt ? Date.now() - this.lastInboundAt : null;
         this.opts.logger.warn(
-          `Relay tunnel: disconnected (code=${code}, reason=${reasonStr})`
+          `Relay tunnel: disconnected (code=${code}, reason=${previewText(reasonStr, 200)}, lastInboundAgoMs=${lastInboundAgoMs ?? "N/A"}, reconnectAttempt=${this.reconnectAttempt})`
         );
         if (this.ws === ws) {
           this.stopHeartbeat();
@@ -5643,7 +5654,9 @@ var RelayClient = class {
         settle();
       });
       ws.on("error", (err) => {
-        this.opts.logger.error(`Relay tunnel: WebSocket error: ${err.message}`);
+        this.opts.logger.error(
+          `Relay tunnel: WebSocket error: ${err.message} (readyState=${ws.readyState}, reconnectAttempt=${this.reconnectAttempt}, url=${wsUrl.toString()})`
+        );
         settle();
       });
     });
@@ -5654,13 +5667,16 @@ var RelayClient = class {
     if (text === "pong") {
       return;
     }
-    const preview = text.length <= 500 ? text : text.substring(0, 500) + "\u2026";
-    this.opts.logger.info(`Relay tunnel: \u2605 received message (${text.length} chars): ${preview}`);
+    this.opts.logger.info(
+      `Relay tunnel: \u2605 received message (${text.length} chars): ${previewText(text)}`
+    );
     let frame;
     try {
       frame = JSON.parse(text);
     } catch {
-      this.opts.logger.warn("Relay tunnel: received invalid frame, ignoring");
+      this.opts.logger.warn(
+        `Relay tunnel: received invalid frame, ignoring (preview=${previewText(text, 200)})`
+      );
       return;
     }
     this.opts.logger.info(`Relay tunnel: parsed frame type=${frame.type}, id=${"id" in frame ? frame.id : "N/A"}`);
@@ -5775,6 +5791,32 @@ import { randomUUID as randomUUID2 } from "crypto";
 import crypto from "crypto";
 import fs from "fs";
 import path from "path";
+function previewText2(text, max = 200) {
+  if (!text) return "";
+  return text.length <= max ? text : `${text.substring(0, max)}\u2026`;
+}
+function findHeaderValue(headers, key) {
+  if (!headers) return void 0;
+  const lowerKey = key.toLowerCase();
+  for (const [headerKey, headerValue] of Object.entries(headers)) {
+    if (headerKey.toLowerCase() === lowerKey) {
+      return headerValue;
+    }
+  }
+  return void 0;
+}
+function summarizeRequestHeaders(headers) {
+  const contentType = findHeaderValue(headers, "content-type");
+  const requestId = findHeaderValue(headers, "x-request-id");
+  const parts = [];
+  if (contentType) {
+    parts.push(`contentType=${contentType}`);
+  }
+  if (requestId) {
+    parts.push(`xRequestId=${previewText2(requestId, 120)}`);
+  }
+  return parts.length ? `, ${parts.join(", ")}` : "";
+}
 var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 function base64UrlEncode(buf) {
   return buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
@@ -5814,11 +5856,96 @@ function buildDeviceAuthPayload(params) {
     params.nonce
   ].join("|");
 }
-function resolveStateDir2() {
-  return resolveStateDir();
+function resolveClientStateDir(stateDir) {
+  return stateDir ?? resolveStateDir();
+}
+function ensureDir(filePath) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+}
+function resolveIdentityPath(stateDir) {
+  return path.join(stateDir, "identity", "device.json");
+}
+function normalizeDeviceAuthRole(role) {
+  return role.trim();
+}
+function normalizeDeviceAuthScopes(scopes) {
+  const out = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    const trimmed = scope.trim();
+    if (trimmed) {
+      out.add(trimmed);
+    }
+  }
+  return [...out].sort();
+}
+function resolveDeviceAuthPath(stateDir) {
+  return path.join(stateDir, "identity", "device-auth.json");
+}
+function readDeviceAuthStore(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    const raw = fs.readFileSync(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed?.version !== 1 || typeof parsed.deviceId !== "string") return null;
+    if (!parsed.tokens || typeof parsed.tokens !== "object") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeDeviceAuthStore(filePath, store) {
+  ensureDir(filePath);
+  fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}
+`, {
+    mode: 384
+  });
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function loadDeviceAuthToken(params) {
+  const store = readDeviceAuthStore(resolveDeviceAuthPath(params.stateDir));
+  if (!store || store.deviceId !== params.deviceId) return null;
+  const entry = store.tokens[normalizeDeviceAuthRole(params.role)];
+  if (!entry || typeof entry.token !== "string") return null;
+  return entry;
+}
+function storeDeviceAuthToken(params) {
+  const filePath = resolveDeviceAuthPath(params.stateDir);
+  const existing = readDeviceAuthStore(filePath);
+  const role = normalizeDeviceAuthRole(params.role);
+  const next = {
+    version: 1,
+    deviceId: params.deviceId,
+    tokens: existing && existing.deviceId === params.deviceId && existing.tokens ? { ...existing.tokens } : {}
+  };
+  const entry = {
+    token: params.token,
+    role,
+    scopes: normalizeDeviceAuthScopes(params.scopes),
+    updatedAtMs: Date.now()
+  };
+  next.tokens[role] = entry;
+  writeDeviceAuthStore(filePath, next);
+  return entry;
+}
+function clearDeviceAuthToken(params) {
+  const filePath = resolveDeviceAuthPath(params.stateDir);
+  const store = readDeviceAuthStore(filePath);
+  if (!store || store.deviceId !== params.deviceId) return;
+  const role = normalizeDeviceAuthRole(params.role);
+  if (!store.tokens[role]) return;
+  const next = {
+    version: 1,
+    deviceId: store.deviceId,
+    tokens: { ...store.tokens }
+  };
+  delete next.tokens[role];
+  writeDeviceAuthStore(filePath, next);
 }
-function loadOrCreateDeviceIdentity() {
-  const filePath = path.join(resolveStateDir2(), "identity", "device.json");
+function loadOrCreateDeviceIdentity(stateDir) {
+  const filePath = resolveIdentityPath(stateDir);
   try {
     if (fs.existsSync(filePath)) {
       const raw = fs.readFileSync(filePath, "utf8");
@@ -5848,6 +5975,7 @@ function loadOrCreateDeviceIdentity() {
     ...identity,
     createdAtMs: Date.now()
   };
+  ensureDir(filePath);
   fs.writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}
 `, {
     mode: 384
@@ -5857,7 +5985,8 @@ function loadOrCreateDeviceIdentity() {
 var TunnelProxy = class _TunnelProxy {
   constructor(opts) {
     this.opts = opts;
-    this.deviceIdentity = loadOrCreateDeviceIdentity();
+    this.stateDir = resolveClientStateDir(opts.stateDir);
+    this.deviceIdentity = loadOrCreateDeviceIdentity(this.stateDir);
     opts.logger.info(
       `TunnelProxy: loaded device identity (deviceId=${this.deviceIdentity.deviceId})`
     );
@@ -5873,6 +6002,13 @@ var TunnelProxy = class _TunnelProxy {
   gatewayWsPending = [];
   /** 设备身份，用于 Gateway connect 握手 */
   deviceIdentity;
+  stateDir;
+  pushGatewayPending(payload, reason) {
+    this.gatewayWsPending.push(payload);
+    this.opts.logger.info(
+      `TunnelProxy: gateway WS pending queue size=${this.gatewayWsPending.length} (${reason})`
+    );
+  }
   resolveGatewayConnectAuth() {
     const token = this.opts.gatewayToken?.trim() || void 0;
     const password = this.opts.gatewayPassword?.trim() || void 0;
@@ -5884,6 +6020,65 @@ var TunnelProxy = class _TunnelProxy {
       password
     };
   }
+  loadStoredDeviceToken(role) {
+    return loadDeviceAuthToken({
+      stateDir: this.stateDir,
+      deviceId: this.deviceIdentity.deviceId,
+      role
+    })?.token ?? void 0;
+  }
+  buildGatewayConnectAuth(role) {
+    const explicitAuth = this.resolveGatewayConnectAuth();
+    const authPassword = explicitAuth?.password?.trim() || void 0;
+    const explicitGatewayToken = explicitAuth?.token?.trim() || void 0;
+    const deviceToken = explicitGatewayToken ? void 0 : this.loadStoredDeviceToken(role);
+    const authToken = explicitGatewayToken ?? deviceToken;
+    const auth = authToken || authPassword || deviceToken ? {
+      token: authToken,
+      deviceToken,
+      password: authPassword
+    } : void 0;
+    return {
+      auth,
+      authToken,
+      authPassword,
+      deviceToken
+    };
+  }
+  storeIssuedDeviceToken(params) {
+    const token = params.authInfo?.deviceToken;
+    if (typeof token !== "string" || !token.trim()) {
+      return;
+    }
+    const role = typeof params.authInfo?.role === "string" && params.authInfo.role.trim() ? params.authInfo.role.trim() : params.fallbackRole;
+    const scopes = Array.isArray(params.authInfo?.scopes) ? params.authInfo.scopes.filter(
+      (scope) => typeof scope === "string" && !!scope.trim()
+    ) : params.fallbackScopes;
+    storeDeviceAuthToken({
+      stateDir: this.stateDir,
+      deviceId: this.deviceIdentity.deviceId,
+      role,
+      token: token.trim(),
+      scopes
+    });
+  }
+  maybeClearStoredDeviceTokenOnMismatch(code, reason) {
+    const explicitAuth = this.resolveGatewayConnectAuth();
+    if (explicitAuth?.token || explicitAuth?.password) {
+      return;
+    }
+    if (code !== 1008 || !reason.toLowerCase().includes("device token mismatch")) {
+      return;
+    }
+    clearDeviceAuthToken({
+      stateDir: this.stateDir,
+      deviceId: this.deviceIdentity.deviceId,
+      role: "operator"
+    });
+    this.opts.logger.warn(
+      `TunnelProxy: cleared stale stored device token after gateway mismatch (deviceId=${this.deviceIdentity.deviceId})`
+    );
+  }
   buildLocalGatewayAuthAttempts(baseHeaders) {
     const auth = this.resolveGatewayConnectAuth();
     const attempts = [];
@@ -5921,19 +6116,21 @@ var TunnelProxy = class _TunnelProxy {
     }
     return attempts;
   }
-  async sendHttpResponse(frameId, res) {
+  async sendHttpResponse(params) {
+    const { frameId, method, path: path2, authLabel, startedAtMs, res } = params;
     const contentType = res.headers.get("content-type") ?? "";
     const isStreaming = contentType.includes("text/event-stream");
+    const elapsedMs = Date.now() - startedAtMs;
     this.opts.logger.info(
-      `TunnelProxy: response status=${res.status}, content-type=${contentType}, streaming=${isStreaming}`
+      `TunnelProxy: HTTP id=${frameId} ${method} ${path2} <= ${res.status} (${elapsedMs}ms, auth=${authLabel}, content-type=${contentType}, streaming=${isStreaming})`
     );
     if (isStreaming && res.body) {
-      await this.streamResponse(frameId, res);
+      await this.streamResponse(frameId, res, startedAtMs);
       return;
     }
     const body = await res.text();
     this.opts.logger.info(
-      `TunnelProxy: response status=${res.status}, body=${body.substring(0, 200)}`
+      `TunnelProxy: HTTP id=${frameId} response body=${previewText2(body)}`
     );
     const headers = {};
     res.headers.forEach((value, key) => {
@@ -5982,7 +6179,7 @@ var TunnelProxy = class _TunnelProxy {
     if (this.gatewayWsReady && this.gatewayWs?.readyState === wrapper_default.OPEN) {
       this.gatewayWs.send(payload);
     } else {
-      this.gatewayWsPending.push(payload);
+      this.pushGatewayPending(payload, "raw frame queued before gateway WS ready");
     }
   }
   /** 清理所有代理的 WebSocket 连接 */
@@ -6016,12 +6213,14 @@ var TunnelProxy = class _TunnelProxy {
     this.gatewayWsConnecting = true;
     this.gatewayWsReady = false;
     const wsUrl = this.opts.gatewayBaseUrl.replace(/^http/, "ws");
-    this.opts.logger.info(`TunnelProxy: RPC WS connecting to gateway ${wsUrl}`);
+    this.opts.logger.info(
+      `TunnelProxy: RPC WS connecting to gateway ${wsUrl} (pending=${this.gatewayWsPending.length})`
+    );
     const ws = new wrapper_default(wsUrl);
     ws.on("open", () => {
       this.gatewayWs = ws;
       this.opts.logger.info(
-        "TunnelProxy: RPC WS tcp connected, waiting for connect.challenge"
+        `TunnelProxy: RPC WS tcp connected, waiting for connect.challenge (pending=${this.gatewayWsPending.length})`
       );
     });
     ws.on("message", (data) => {
@@ -6048,15 +6247,16 @@ var TunnelProxy = class _TunnelProxy {
       }
       if (frame.type === "event" && frame.event === "connect.challenge") {
         const challengeNonce = frame.payload?.nonce ?? "";
-        this.opts.logger.info(
-          `TunnelProxy: received connect.challenge (nonce=${challengeNonce}), sending connect request with device identity`
-        );
+        const connectRequestId = `tunnel-connect-${randomUUID2()}`;
         const role = "operator";
         const scopes = ["operator.admin"];
+        const gatewayConnectAuth = this.buildGatewayConnectAuth(role);
+        this.opts.logger.info(
+          `TunnelProxy: received connect.challenge (nonce=${challengeNonce}, connectReqId=${connectRequestId}, hasToken=${!!gatewayConnectAuth.authToken}, hasPassword=${!!gatewayConnectAuth.authPassword}, hasDeviceToken=${!!gatewayConnectAuth.deviceToken}), sending connect request with device identity`
+        );
         const signedAtMs = Date.now();
         const clientId = "gateway-client";
         const clientMode = "backend";
-        const gatewayAuth = this.resolveGatewayConnectAuth();
         const authPayload = buildDeviceAuthPayload({
           deviceId: this.deviceIdentity.deviceId,
           clientId,
@@ -6064,7 +6264,7 @@ var TunnelProxy = class _TunnelProxy {
           role,
           scopes,
           signedAtMs,
-          token: gatewayAuth?.token ?? null,
+          token: gatewayConnectAuth.authToken ?? null,
           nonce: challengeNonce
         });
         const signature = signDevicePayload(
@@ -6073,7 +6273,7 @@ var TunnelProxy = class _TunnelProxy {
         );
         const connectReq = {
           type: "req",
-          id: `tunnel-connect-${randomUUID2()}`,
+          id: connectRequestId,
           method: "connect",
           params: {
             minProtocol: 3,
@@ -6086,7 +6286,7 @@ var TunnelProxy = class _TunnelProxy {
             },
             role,
             scopes,
-            ...gatewayAuth ? { auth: gatewayAuth } : {},
+            ...gatewayConnectAuth.auth ? { auth: gatewayConnectAuth.auth } : {},
             device: {
               id: this.deviceIdentity.deviceId,
               publicKey: publicKeyRawBase64UrlFromPem(
@@ -6102,6 +6302,11 @@ var TunnelProxy = class _TunnelProxy {
         return;
       }
       if (frame.type === "res" && frame.ok === true && frame.payload?.type === "hello-ok") {
+        this.storeIssuedDeviceToken({
+          fallbackRole: "operator",
+          fallbackScopes: ["operator.admin"],
+          authInfo: frame.payload?.auth
+        });
         this.gatewayWsReady = true;
         this.gatewayWsConnecting = false;
         this.opts.logger.info(
@@ -6115,7 +6320,7 @@ var TunnelProxy = class _TunnelProxy {
       }
       if (frame.type === "res" && frame.ok === false && !this.gatewayWsReady) {
         this.opts.logger.error(
-          `TunnelProxy: RPC WS handshake failed: ${JSON.stringify(frame.error)}`
+          `TunnelProxy: RPC WS handshake failed (pending=${this.gatewayWsPending.length}): ${previewText2(JSON.stringify(frame.error), 500)}`
         );
         ws.close();
         return;
@@ -6123,17 +6328,23 @@ var TunnelProxy = class _TunnelProxy {
       this.opts.client.sendRaw(text);
     });
     ws.on("close", (code, reason) => {
+      const wasReady = this.gatewayWsReady;
+      const pendingCount = this.gatewayWsPending.length;
+      const reasonText = reason.toString();
       this.opts.logger.info(
-        `TunnelProxy: RPC WS closed by gateway (code=${code}, reason=${reason.toString()})`
+        `TunnelProxy: RPC WS closed by gateway (code=${code}, reason=${reasonText}, ready=${wasReady}, pending=${pendingCount}, activeWs=${this.wsConnections.size})`
       );
       if (this.gatewayWs === ws) {
         this.gatewayWs = null;
         this.gatewayWsReady = false;
       }
       this.gatewayWsConnecting = false;
+      this.maybeClearStoredDeviceTokenOnMismatch(code, reasonText);
     });
     ws.on("error", (err) => {
-      this.opts.logger.warn(`TunnelProxy: RPC WS error: ${err.message}`);
+      this.opts.logger.warn(
+        `TunnelProxy: RPC WS error: ${err.message} (ready=${this.gatewayWsReady}, pending=${this.gatewayWsPending.length}, activeWs=${this.wsConnections.size})`
+      );
       this.gatewayWsConnecting = false;
       if (this.gatewayWs === ws) {
         this.gatewayWs = null;
@@ -6154,7 +6365,10 @@ var TunnelProxy = class _TunnelProxy {
       this.opts.logger.info(
         `TunnelProxy: req id=${frame.id} queued, gateway WS not ready yet`
       );
-      this.gatewayWsPending.push(payload);
+      this.pushGatewayPending(
+        payload,
+        `req id=${frame.id} queued before gateway WS handshake`
+      );
     }
   }
   // ─── 路径映射 ───
@@ -6166,7 +6380,9 @@ var TunnelProxy = class _TunnelProxy {
   }
   // ─── HTTP 请求代理 ───
   async handleHttpRequest(frame) {
-    const url = new URL(this.mapPath(frame.path), this.opts.gatewayBaseUrl);
+    const mappedPath = this.mapPath(frame.path);
+    const url = new URL(mappedPath, this.opts.gatewayBaseUrl);
+    const startedAtMs = Date.now();
     const localHeaders = {};
     for (const [k, v] of Object.entries(frame.headers ?? {})) {
       const lower = k.toLowerCase();
@@ -6176,11 +6392,14 @@ var TunnelProxy = class _TunnelProxy {
     }
     const authAttempts = this.buildLocalGatewayAuthAttempts(localHeaders);
     this.opts.logger.info(
-      `TunnelProxy: HTTP ${frame.method} ${frame.path} \u2192 ${url.toString()}, body=${frame.body?.substring(0, 200)}`
+      `TunnelProxy: HTTP id=${frame.id} ${frame.method} ${frame.path} \u2192 ${url.toString()}${summarizeRequestHeaders(frame.headers)}, authAttempts=${authAttempts.map((attempt) => attempt.label).join(" -> ")}, body=${previewText2(frame.body)}`
     );
     try {
       for (let attemptIndex = 0; attemptIndex < authAttempts.length; attemptIndex++) {
         const attempt = authAttempts[attemptIndex];
+        this.opts.logger.info(
+          `TunnelProxy: HTTP id=${frame.id} attempt ${attemptIndex + 1}/${authAttempts.length} auth=${attempt.label}`
+        );
         const res = await fetch(url.toString(), {
           method: frame.method,
           headers: attempt.headers,
@@ -6190,23 +6409,34 @@ var TunnelProxy = class _TunnelProxy {
         if (res.status === 401 && hasFallback) {
           const body = await res.text();
           this.opts.logger.warn(
-            `TunnelProxy: local gateway auth via ${attempt.label} returned 401, retrying next credential${body ? `, body=${body.substring(0, 200)}` : ""}`
+            `TunnelProxy: HTTP id=${frame.id} local gateway auth via ${attempt.label} returned 401 after ${Date.now() - startedAtMs}ms, retrying next credential${body ? `, body=${previewText2(body)}` : ""}`
           );
           continue;
         }
-        await this.sendHttpResponse(frame.id, res);
+        await this.sendHttpResponse({
+          frameId: frame.id,
+          method: frame.method,
+          path: mappedPath,
+          authLabel: attempt.label,
+          startedAtMs,
+          res
+        });
         return;
       }
     } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.opts.logger.error(
+        `TunnelProxy: HTTP id=${frame.id} ${frame.method} ${mappedPath} failed after ${Date.now() - startedAtMs}ms: ${message}`
+      );
       this.opts.client.send({
         type: "proxy_error",
         id: frame.id,
         status: 502,
-        message: `gateway unreachable: ${err instanceof Error ? err.message : String(err)}`
+        message: `gateway unreachable: ${message}`
       });
     }
   }
-  async streamResponse(requestId, res) {
+  async streamResponse(requestId, res, startedAtMs) {
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
     let chunkCount = 0;
@@ -6228,7 +6458,7 @@ var TunnelProxy = class _TunnelProxy {
         });
       }
       this.opts.logger.info(
-        `TunnelProxy: stream end id=${requestId}, total chunks=${chunkCount}`
+        `TunnelProxy: stream end id=${requestId}, total chunks=${chunkCount}, totalElapsedMs=${Date.now() - startedAtMs}`
       );
       this.opts.client.send({
         type: "stream",
@@ -6238,7 +6468,7 @@ var TunnelProxy = class _TunnelProxy {
       });
     } catch (err) {
       this.opts.logger.error(
-        `TunnelProxy: stream error id=${requestId} after ${chunkCount} chunks: ${err instanceof Error ? err.message : String(err)}`
+        `TunnelProxy: stream error id=${requestId} after ${chunkCount} chunks and ${Date.now() - startedAtMs}ms: ${err instanceof Error ? err.message : String(err)}`
       );
       this.opts.client.send({
         type: "proxy_error",
@@ -6473,6 +6703,7 @@ function createTunnelService(opts) {
           logger
         });
         proxy = new TunnelProxy({
+          stateDir: baseStateDir,
           gatewayBaseUrl: opts.gatewayBaseUrl,
           gatewayAuthMode: opts.gatewayAuthMode,
           gatewayToken: opts.gatewayToken,