agent-dir 0.4.0 → 0.5.0

package/dist/src/telemetry/storage.js

@@ -0,0 +1,133 @@
+import { appendFileSync, chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const CONFIG_DIRECTORY = join(homedir(), ".config", "agent-dir");
+export const TELEMETRY_DIRECTORY = join(CONFIG_DIRECTORY, "telemetry");
+export const LEGACY_TELEMETRY_FILE = join(CONFIG_DIRECTORY, "telemetry.jsonl");
+const LEGACY_ARCHIVE_FILE = join(CONFIG_DIRECTORY, "telemetry.legacy-archive.jsonl");
+function safeSegment(value) {
+    const safe = value
+        .replace(/[^A-Za-z0-9._-]/g, "_")
+        .replace(/^\.+$/, "_")
+        .slice(0, 100);
+    return safe || "unknown";
+}
+export function telemetrySessionPath(configId, sessionId) {
+    return join(TELEMETRY_DIRECTORY, safeSegment(configId), `session-${safeSegment(sessionId)}.jsonl`);
+}
+function parseEvents(content) {
+    const events = [];
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const value = JSON.parse(line);
+            if (value &&
+                value.schemaVersion === 1 &&
+                typeof value.configId === "string" &&
+                typeof value.sessionId === "string" &&
+                typeof value.timestamp === "string" &&
+                value.event) {
+                events.push(value);
+            }
+        }
+        catch {
+            // Ignore malformed lines without discarding other valid events.
+        }
+    }
+    return events;
+}
+function readFileEvents(path) {
+    try {
+        return parseEvents(readFileSync(path, "utf8"));
+    }
+    catch {
+        return [];
+    }
+}
+function collectJsonlFiles(directory) {
+    if (!existsSync(directory))
+        return [];
+    const files = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const path = join(directory, entry.name);
+        if (entry.isDirectory())
+            files.push(...collectJsonlFiles(path));
+        else if (entry.isFile() && entry.name.endsWith(".jsonl"))
+            files.push(path);
+    }
+    return files;
+}
+/** Migrate the old shared file once, preserving an archive and avoiding duplicate lines. */
+export function migrateLegacyTelemetry() {
+    if (!existsSync(LEGACY_TELEMETRY_FILE))
+        return;
+    const legacyEvents = readFileEvents(LEGACY_TELEMETRY_FILE);
+    mkdirSync(TELEMETRY_DIRECTORY, { recursive: true, mode: 0o700 });
+    const groups = new Map();
+    for (const event of legacyEvents) {
+        const path = telemetrySessionPath(event.configId, event.sessionId);
+        const group = groups.get(path) ?? [];
+        group.push(event);
+        groups.set(path, group);
+    }
+    for (const [path, events] of groups) {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        let existing = new Set();
+        try {
+            existing = new Set(readFileSync(path, "utf8").split("\n").filter(Boolean));
+        }
+        catch {
+            // New session file.
+        }
+        const missing = events
+            .map((event) => JSON.stringify(event))
+            .filter((line) => {
+            if (existing.has(line))
+                return false;
+            existing.add(line);
+            return true;
+        });
+        if (missing.length) {
+            appendFileSync(path, `${missing.join("\n")}\n`, { encoding: "utf8", mode: 0o600 });
+            chmodSync(path, 0o600);
+        }
+    }
+    let archive = LEGACY_ARCHIVE_FILE;
+    if (existsSync(archive))
+        archive = `${LEGACY_ARCHIVE_FILE}.${Date.now()}`;
+    renameSync(LEGACY_TELEMETRY_FILE, archive);
+}
+export function readAllTelemetryEvents() {
+    migrateLegacyTelemetry();
+    return collectJsonlFiles(TELEMETRY_DIRECTORY)
+        .flatMap(readFileEvents)
+        .sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+export function resetTelemetry(profile, all = false) {
+    if (all) {
+        rmSync(TELEMETRY_DIRECTORY, { recursive: true, force: true });
+        rmSync(LEGACY_TELEMETRY_FILE, { force: true });
+        rmSync(LEGACY_ARCHIVE_FILE, { force: true });
+        for (const entry of existsSync(CONFIG_DIRECTORY)
+            ? readdirSync(CONFIG_DIRECTORY, { withFileTypes: true })
+            : []) {
+            if (entry.isFile() && entry.name.startsWith("telemetry.legacy-archive.jsonl.")) {
+                rmSync(join(CONFIG_DIRECTORY, entry.name), { force: true });
+            }
+        }
+        return;
+    }
+    if (!profile)
+        throw new Error("Specify a profile name or use --all.");
+    rmSync(join(TELEMETRY_DIRECTORY, safeSegment(profile)), { recursive: true, force: true });
+}
+export function ensureTelemetryDirectory() {
+    mkdirSync(TELEMETRY_DIRECTORY, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(TELEMETRY_DIRECTORY, 0o700);
+    }
+    catch {
+        // Best-effort permission hardening.
+    }
+}

package/dist/src/telemetry/types.d.ts

@@ -22,9 +22,27 @@ export interface TelemetryMcpRequestEvent {
     durationMs: number;
     errorCategory?: string;
 }
+export interface TelemetryFileMetric {
+    pathHash: string;
+    contentHash?: string;
+    bytes: number;
+}
 export interface TelemetryToolEvent {
     event: "tool_call";
     tool: string;
+    requestIdHash?: string;
+    inputFingerprint?: string;
+    outputFingerprint?: string;
+    /** Full local-only troubleshooting payload, emitted only at diagnostic level. */
+    diagnosticDetails?: Record<string, unknown>;
+    estimatedInputTokens?: number;
+    estimatedOutputTokens?: number;
+    cumulativeOutputBytes?: number;
+    cumulativeEstimatedOutputTokens?: number;
+    duplicateOutputBytes?: number;
+    textOutputBytes?: number;
+    uniqueFileCount?: number;
+    files?: TelemetryFileMetric[];
     success: boolean;
     durationMs: number;
     inputBytes?: number;
@@ -46,7 +64,8 @@ export interface TelemetryCommandEvent {
 }
 export interface TelemetryTunnelEvent {
     event: "tunnel";
-    state: "online" | "disconnected" | "reconnecting" | "reconnected" | "failed";
+    state: "online" | "disconnected" | "reconnecting" | "reconnected" | "failed" | "health";
+    healthState?: "healthy" | "degraded" | "recovered";
     attempt?: number;
     attempts?: number;
     durationMs?: number;
@@ -70,6 +89,10 @@ export interface TelemetryRuntimeContext {
     mcpClientName?: string;
     mcpClientVersion?: string;
     nodeVersion?: string;
+    distroId?: string;
+    distroName?: string;
+    distroVersion?: string;
+    kernelVersion?: string;
     hostname?: string;
     username?: string;
     processId?: number;

package/dist/src/tools/code.js

@@ -142,7 +142,7 @@ export function findReferences(root, symbol, maxResults = 200, maxBytes = DEFAUL
     return searchCode(root, `\\b${escaped}\\b`, true, maxResults, maxBytes);
 }
 export async function findImports(root, maxResults = 200, maxBytes = DEFAULT_OUTPUT_BYTES) {
-    const matches = await readMatches(root, String.raw `(?:^|[;{}])\\s*import(?:[^"'\\n]*?from\\s*)?["']([^"']+)["']|require\\(\\s*["']([^"']+)["']\\s*\\)`, { codeOnly: true, regex: true, maxResults });
+    const matches = await readMatches(root, String.raw `(?:^|[;{}])\s*import\s*(?:[^"'\n]*?from\s*)?["']([^"']+)["']|require\(\s*["']([^"']+)["']\s*\)`, { codeOnly: true, regex: true, maxResults });
     return boundMatches(matches.map((match) => {
         const captured = match.text.match(/(?:from\s*)?["']([^"']+)["']|require\(\s*["']([^"']+)["']\s*\)/);
         return {

package/dist/src/tools/commands.d.ts

@@ -1,3 +1,10 @@
+import { type ChildProcess } from "node:child_process";
+export declare function appendBoundedOutput(current: string, chunk: Buffer | string): string;
+export declare function commandEnvironment(): NodeJS.ProcessEnv;
+export declare function terminateProcessTree(child: ChildProcess): void;
+export declare function processTreeSpawnOptions(): {
+    detached: boolean;
+};
 export interface CommandResult {
     command: string;
     exitCode: number;

package/dist/src/tools/commands.js

@@ -1,5 +1,58 @@
 import { spawn } from "node:child_process";
 const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+const MAX_CAPTURE_BYTES = 512_000;
+const TRUNCATION_MARKER = "\n…[output truncated at 512 KB]";
+export function appendBoundedOutput(current, chunk) {
+    if (current.endsWith(TRUNCATION_MARKER) ||
+        Buffer.byteLength(current, "utf8") >= MAX_CAPTURE_BYTES)
+        return current;
+    const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    const available = MAX_CAPTURE_BYTES - Buffer.byteLength(current, "utf8");
+    if (incoming.byteLength <= available)
+        return current + incoming.toString("utf8");
+    const markerBytes = Buffer.byteLength(TRUNCATION_MARKER, "utf8");
+    const payloadBytes = Math.max(0, available - markerBytes);
+    let payload = incoming.subarray(0, payloadBytes).toString("utf8");
+    while (Buffer.byteLength(payload, "utf8") > payloadBytes)
+        payload = payload.slice(0, -1);
+    return current + payload + TRUNCATION_MARKER;
+}
+export function commandEnvironment() {
+    return Object.fromEntries(Object.entries(process.env).filter(([key]) => !/(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIAL|AUTHORIZATION|ACCESS[_-]?KEY)/i.test(key)));
+}
+const FORCE_KILL_DELAY_MS = 1_000;
+export function terminateProcessTree(child) {
+    const pid = child.pid;
+    if (!pid || child.killed || child.exitCode !== null)
+        return;
+    if (process.platform === "win32") {
+        const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        killer.on("error", () => child.kill("SIGKILL"));
+        return;
+    }
+    try {
+        process.kill(-pid, "SIGTERM");
+    }
+    catch {
+        child.kill("SIGTERM");
+    }
+    const forceTimer = setTimeout(() => {
+        try {
+            process.kill(-pid, "SIGKILL");
+        }
+        catch {
+            child.kill("SIGKILL");
+        }
+    }, FORCE_KILL_DELAY_MS);
+    forceTimer.unref();
+    child.once("close", () => clearTimeout(forceTimer));
+}
+export function processTreeSpawnOptions() {
+    return { detached: process.platform !== "win32" };
+}
 export function isCommandBlacklisted(command, args = [], blacklistedCommands = []) {
     const invocation = [command, ...args];
     return blacklistedCommands.some((entry) => {
@@ -17,7 +70,12 @@ export function runCommand(root, command, args = [], allowedCommands = [], black
     if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string"))
         throw new Error("Command arguments must be strings.");
     return new Promise((resolve, reject) => {
-        const child = spawn(command, args, { cwd: root, shell: false, env: process.env });
+        const child = spawn(command, args, {
+            cwd: root,
+            shell: false,
+            env: commandEnvironment(),
+            ...processTreeSpawnOptions(),
+        });
         let stdout = "";
         let stderr = "";
         let finished = false;
@@ -27,14 +85,14 @@ export function runCommand(root, command, args = [], allowedCommands = [], black
                 return;
             finished = true;
             clearTimeout(timer);
-            child.kill("SIGTERM");
+            terminateProcessTree(child);
             reject(new Error(`Command '${command}' was aborted.`));
         };
         timer = setTimeout(() => {
             if (finished)
                 return;
             finished = true;
-            child.kill("SIGTERM");
+            terminateProcessTree(child);
             signal?.removeEventListener("abort", abort);
             reject(new Error(`Command '${command}' timed out after ${timeoutMs}ms.`));
         }, timeoutMs);
@@ -44,10 +102,10 @@ export function runCommand(root, command, args = [], allowedCommands = [], black
         }
         signal?.addEventListener("abort", abort, { once: true });
         child.stdout.on("data", (chunk) => {
-            stdout += chunk.toString();
+            stdout = appendBoundedOutput(stdout, chunk);
         });
         child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString();
+            stderr = appendBoundedOutput(stderr, chunk);
         });
         child.on("error", (error) => {
             if (finished)

package/dist/src/tools/git.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { appendBoundedOutput, commandEnvironment, processTreeSpawnOptions, terminateProcessTree, } from "./commands.js";
 function validatePaths(paths) {
     if (!Array.isArray(paths) ||
         paths.length === 0 ||
@@ -8,7 +9,12 @@ function validatePaths(paths) {
 }
 function runGit(root, args, timeoutMs = 30000) {
     return new Promise((resolve, reject) => {
-        const child = spawn("git", args, { cwd: root, shell: false, env: process.env });
+        const child = spawn("git", args, {
+            cwd: root,
+            shell: false,
+            env: commandEnvironment(),
+            ...processTreeSpawnOptions(),
+        });
         let stdout = "";
         let stderr = "";
         let finished = false;
@@ -16,14 +22,14 @@ function runGit(root, args, timeoutMs = 30000) {
             if (finished)
                 return;
             finished = true;
-            child.kill("SIGTERM");
+            terminateProcessTree(child);
             reject(new Error(`git ${args.join(" ")} timed out after ${timeoutMs}ms.`));
         }, timeoutMs);
         child.stdout.on("data", (chunk) => {
-            stdout += chunk.toString();
+            stdout = appendBoundedOutput(stdout, chunk);
         });
         child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString();
+            stderr = appendBoundedOutput(stderr, chunk);
         });
         child.on("error", (error) => {
             if (finished)

package/dist/src/tools/npm.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { promises as fs } from "node:fs";
 import path from "node:path";
+import { appendBoundedOutput, commandEnvironment, processTreeSpawnOptions, terminateProcessTree, } from "./commands.js";
 export function runNpm(root, script, timeoutMs = 120000, allowedScripts = [], signal) {
     if (!/^[A-Za-z0-9:_-]+$/.test(script))
         throw new Error("Invalid npm script name.");
@@ -21,7 +22,8 @@ export function runNpm(root, script, timeoutMs = 120000, allowedScripts = [], si
             const child = spawn(executable, ["run", script], {
                 cwd: root,
                 shell: false,
-                env: process.env,
+                env: commandEnvironment(),
+                ...processTreeSpawnOptions(),
             });
             let stdout = "";
             let stderr = "";
@@ -32,14 +34,14 @@ export function runNpm(root, script, timeoutMs = 120000, allowedScripts = [], si
                     return;
                 finished = true;
                 clearTimeout(timer);
-                child.kill("SIGTERM");
+                terminateProcessTree(child);
                 reject(new Error(`npm run ${script} was aborted.`));
             };
             timer = setTimeout(() => {
                 if (finished)
                     return;
                 finished = true;
-                child.kill("SIGTERM");
+                terminateProcessTree(child);
                 signal?.removeEventListener("abort", abort);
                 reject(new Error(`npm run ${script} timed out after ${timeoutMs}ms.`));
             }, timeoutMs);
@@ -49,10 +51,10 @@ export function runNpm(root, script, timeoutMs = 120000, allowedScripts = [], si
             }
             signal?.addEventListener("abort", abort, { once: true });
             child.stdout.on("data", (chunk) => {
-                stdout += chunk.toString();
+                stdout = appendBoundedOutput(stdout, chunk);
             });
             child.stderr.on("data", (chunk) => {
-                stderr += chunk.toString();
+                stderr = appendBoundedOutput(stderr, chunk);
             });
             child.on("error", (error) => {
                 if (!finished) {

package/dist/src/tunnel.js

@@ -6,6 +6,7 @@ const HEALTH_TIMEOUT_MS = 5_000;
 const HEALTH_FAILURE_THRESHOLD = 2;
 const RECONNECT_DELAY_MS = 1_000;
 const MAX_RECONNECT_ATTEMPTS = 5;
+const HEALTH_PATH = "/__health";
 const ANSI_ESCAPE = new RegExp(String.fromCharCode(0x1b) + String.raw `\[[0-?]*[ -/]*[@-~]`, "g");
 function cleanOutput(value) {
     return value.toString().replace(ANSI_ESCAPE, "");
@@ -13,8 +14,12 @@ function cleanOutput(value) {
 function writeLine(line = "") {
     process.stdout.write(`${line}\r\n`);
 }
-function publicUrl(subdomain) {
-    return `https://${subdomain}.wormhole.bar`;
+function publicUrl(options) {
+    if (options.provider === "cloudflared" && options.hostname)
+        return `https://${options.hostname}`;
+    if (options.subdomain)
+        return `https://${options.subdomain}.wormhole.bar`;
+    throw new Error("Tunnel URL cannot be determined from the configured options.");
 }
 function reasonCategory(reason) {
     if (/timeout/i.test(reason))
@@ -34,8 +39,8 @@ function failureFromLine(line) {
     return registration?.[1] ? `Wormhole registration failed: ${registration[1].trim()}` : undefined;
 }
 export function startTunnel(options) {
-    if (options.provider !== "wormhole")
-        return Promise.reject(new Error(`Unsupported tunnel provider: ${options.provider}`));
+    if (options.provider === "cloudflared" && !options.hostname)
+        return Promise.reject(new Error("Cloudflared requires a hostname routed to a named Cloudflare Tunnel."));
     return new Promise((resolve, reject) => {
         const telemetry = options.telemetry && options.telemetry.level !== "none"
             ? new TelemetryRecorder({
@@ -55,6 +60,7 @@ export function startTunnel(options) {
         let healthTimer;
         let stopped = false;
         let healthFailures = 0;
+        let healthState = "healthy";
         const record = (event) => {
             if (!telemetry)
                 return;
@@ -75,6 +81,8 @@ export function startTunnel(options) {
                 });
             else if (event.type === "reconnected")
                 telemetry.record({ event: "tunnel", state: "reconnected", attempt: event.attempt });
+            else if (event.type === "health")
+                telemetry.record({ event: "tunnel", state: "health", healthState: event.state });
             else
                 telemetry.record({
                     event: "tunnel",
@@ -106,9 +114,16 @@ export function startTunnel(options) {
                 writeLine(`    MCP endpoint : ${event.url}/mcp`);
                 writeLine();
             }
+            else if (event.type === "health") {
+                if (event.state === "degraded")
+                    writeLine("  ⚠ TUNNEL HEALTH DEGRADED");
+                else if (event.state === "recovered")
+                    writeLine("  ✓ TUNNEL HEALTH RECOVERED");
+            }
             else {
-                writeLine(`  ✖ TUNNEL OFFLINE  ${event.reason}`);
-                writeLine(`    Reconnect attempts exhausted: ${event.attempts}`);
+                writeLine(`  ⚠ TUNNEL RECOVERY CYCLE EXHAUSTED  ${event.reason}`);
+                writeLine(`    Attempts completed : ${event.attempts}`);
+                writeLine("    Starting a fresh reconnect cycle.");
             }
         };
         const cleanupTimers = () => {
@@ -135,20 +150,29 @@ export function startTunnel(options) {
                 if (!url || stopped || reconnecting)
                     return;
                 try {
-                    const response = await fetch(url, {
+                    // A 401 is expected: it proves the public tunnel reaches the authenticated server.
+                    // Never send the Agent Dir bearer token to the public hostname.
+                    const response = await fetch(new URL(HEALTH_PATH, url), {
                         method: "HEAD",
-                        ...(options.token ? { headers: { authorization: `Bearer ${options.token}` } } : {}),
                         signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
                     });
+                    if (!response.ok && response.status !== 401)
+                        throw new Error(`Health check returned HTTP ${response.status}.`);
                     healthFailures = 0;
-                    if (!response)
-                        return;
+                    if (healthState === "degraded") {
+                        healthState = "healthy";
+                        emit({ type: "health", state: "recovered" });
+                    }
                 }
                 catch {
                     healthFailures += 1;
+                    if (healthFailures === 1 && healthState === "healthy") {
+                        healthState = "degraded";
+                        emit({ type: "health", state: "degraded" });
+                    }
                     if (healthFailures >= HEALTH_FAILURE_THRESHOLD) {
                         healthFailures = 0;
-                        handleDisconnect("Public tunnel health check failed.");
+                        handleDisconnect("Tunnel health check failed.");
                     }
                 }
             }, HEALTH_INTERVAL_MS);
@@ -157,10 +181,17 @@ export function startTunnel(options) {
         const spawnTunnel = (attempt) => {
             if (stopped)
                 return;
-            const args = ["http", String(options.port)];
-            if (!options.random && options.subdomain)
+            reconnecting = false;
+            const args = options.provider === "wormhole" ? ["http", String(options.port)] : ["tunnel", "run"];
+            if (options.provider === "wormhole" && !options.random && options.subdomain)
                 args.push("--subdomain", options.subdomain);
-            child = spawn("wormhole", args, { stdio: ["ignore", "pipe", "pipe"] });
+            const executable = options.provider === "wormhole" ? "wormhole" : "cloudflared";
+            child = spawn(executable, args, {
+                stdio: ["ignore", "pipe", "pipe"],
+                env: options.provider === "cloudflared" && options.cloudflaredToken
+                    ? { ...process.env, TUNNEL_TOKEN: options.cloudflaredToken }
+                    : process.env,
+            });
             let buffer = "";
             let connected = false;
             const cleanupAttempt = () => {
@@ -200,7 +231,7 @@ export function startTunnel(options) {
                     if (!resolved) {
                         if (!child) {
                             stop();
-                            reject(new Error("Wormhole connected without a child process."));
+                            reject(new Error(`${options.provider} connected without a child process.`));
                             return;
                         }
                         resolved = true;
@@ -225,10 +256,16 @@ export function startTunnel(options) {
                     return;
                 }
                 const explicit = line.match(/https:\/\/[^\s"'<>]+/)?.[0]?.replace(/[),.;]+$/, "");
-                if (explicit)
+                if (options.provider === "wormhole" && explicit)
                     connectedAt(explicit);
-                else if (/Status\s+.*connected/i.test(line) && options.subdomain)
-                    connectedAt(publicUrl(options.subdomain));
+                else if (options.provider === "wormhole" &&
+                    /Status\s+.*connected/i.test(line) &&
+                    options.subdomain)
+                    connectedAt(publicUrl(options));
+                else if (options.provider === "cloudflared" &&
+                    /registered tunnel connection|connection .* registered/i.test(line) &&
+                    options.hostname)
+                    connectedAt(publicUrl(options));
             };
             const onData = (chunk) => {
                 buffer += cleanOutput(chunk);
@@ -237,12 +274,12 @@ export function startTunnel(options) {
                 for (const line of lines)
                     processLine(line);
             };
-            const onError = (error) => disconnect(`Wormhole error: ${error.message}`);
+            const onError = (error) => disconnect(`${executable} error: ${error.message}`);
             const onExit = (code, signal) => {
                 const detail = signal ? `signal ${signal}` : `code ${code}`;
                 disconnect(startup
-                    ? `Wormhole exited before the tunnel was established (${detail}).`
-                    : `Wormhole process exited (${detail}).`);
+                    ? `${executable} exited before the tunnel was established (${detail}).`
+                    : `${executable} process exited (${detail}).`);
             };
             child.stdout?.on("data", onData);
             child.stderr?.on("data", onData);
@@ -250,17 +287,19 @@ export function startTunnel(options) {
             child.once("exit", onExit);
             timer = setTimeout(() => {
                 if (!connected)
-                    disconnect(`Timed out waiting for Wormhole to establish the tunnel after ${STARTUP_TIMEOUT_MS / 1000}s.`);
+                    disconnect(`Timed out waiting for ${executable} to establish the tunnel after ${STARTUP_TIMEOUT_MS / 1000}s.`);
             }, STARTUP_TIMEOUT_MS);
         };
         const handleDisconnect = (reason) => {
             if (stopped || reconnecting)
                 return;
             reconnecting = true;
+            if (child && !child.killed)
+                child.kill("SIGTERM");
             emit({ type: "disconnected", reason });
             if (attempts >= MAX_RECONNECT_ATTEMPTS) {
                 emit({ type: "failed", reason, attempts });
-                return;
+                attempts = 0;
             }
             attempts += 1;
             emit({ type: "reconnecting", attempt: attempts, reason });

package/dist/src/types.d.ts

@@ -6,8 +6,20 @@ export interface NpmConfig {
 export interface Profile {
     directory: string;
     port: number;
-    tunnel: "none" | "wormhole";
+    tunnel: "none" | "wormhole" | "cloudflared";
+    defaultTunnel?: "none" | "wormhole" | "cloudflared";
+    tunnels?: {
+        wormhole?: {
+            subdomain?: string;
+            random?: boolean;
+        };
+        cloudflared?: {
+            hostname: string;
+            token?: string;
+        };
+    };
     subdomain?: string;
+    hostname?: string;
     token?: string;
     npm?: NpmConfig;
     commands?: string[];
@@ -40,9 +52,11 @@ export interface RequestLog {
     tool?: string;
 }
 export interface TunnelOptions {
-    provider: "wormhole";
+    provider: "wormhole" | "cloudflared";
     port: number;
+    cloudflaredToken?: string;
     subdomain?: string;
+    hostname?: string;
     random?: boolean;
     token?: string;
     telemetry?: TelemetryConfig;
@@ -72,4 +86,7 @@ export type TunnelEvent = {
     type: "failed";
     reason: string;
     attempts: number;
+} | {
+    type: "health";
+    state: "healthy" | "degraded" | "recovered";
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dir",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Expose a local project to an AI agent through authenticated MCP, filesystem tools, and allowlisted development commands",
   "repository": {
     "type": "git",