agent-tower 0.7.4 → 0.7.5-beta.5

package/dist/services/preview-runtime-manager.js

@@ -1,82 +1,30 @@
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import http from 'node:http';
 import https from 'node:https';
-import { Tunnel } from 'cloudflared';
-import { AccessAuthService, isAccessAuthCookieName, } from './access-auth.service.js';
-import { TUNNEL_SESSION_COOKIE_NAME } from '../utils/tunnel-cookie.js';
-import { ensureCloudflaredBinary } from './cloudflared-runtime.js';
-import { stopCloudflaredTunnel, trackCloudflaredTunnel, waitForTunnelBinary } from './cloudflared-process.js';
+import { AccessAuthService } from './access-auth.service.js';
+import { buildPreviewBridgeScript, injectPreviewBridge } from './preview-bridge.js';
+import { filterTargetCookieHeader, parseCookieHeader, previewCookieScopeName, rewriteTargetCookie, } from './preview-cookies.js';
+import { classifyPreviewRequest, firstHeaderValue, requestProtocol } from './preview-proxy.js';
 import { writeErrorLog } from '../utils/error-log.js';
+export { rewriteTargetCookie } from './preview-cookies.js';
+/**
+ * Dedicated-origin preview gateways.
+ *
+ * Each workspace preview opened from a browser that can reach extra ports on
+ * the Agent Tower host gets its own root-path HTTP server. The previewed app
+ * then owns the whole URL space (`/login`, `/assets`, SPA history, cookies)
+ * without any rewriting. Browsers that cannot reach those ports use the
+ * same-origin `/view/:workspaceId/` proxy instead (see preview-proxy.ts).
+ */
 export const PREVIEW_GATEWAY_TOKEN_PARAM = '__agent_tower_preview_token';
-export const PREVIEW_BRIDGE_PATH = '/__agent_tower_preview_bridge.js';
 export const PREVIEW_HEARTBEAT_PATH = '/__agent_tower_preview_heartbeat';
 const DEFAULT_IDLE_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_LEASE_TTL_MS = 3 * 60 * 1000;
 const DEFAULT_SWEEP_INTERVAL_MS = 30 * 1000;
-const TUNNEL_STARTUP_TIMEOUT_MS = 30 * 1000;
 const PREVIEW_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
-const QUICK_TUNNEL_OPTIONS = { '--no-autoupdate': true };
-const PREVIEW_BRIDGE_SCRIPT = `(() => {
-  const previewSource = 'agent-tower-preview';
-  const hostSource = 'agent-tower-preview-host';
-  const loopbackHosts = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
-  const post = (message) => {
-    if (window.parent !== window) window.parent.postMessage({ source: previewSource, ...message }, '*');
-  };
-  const sendLocation = () => post({ type: 'location', href: window.location.href, title: document.title });
-  const scheduleLocation = () => window.setTimeout(sendLocation, 0);
-
-  const nativePushState = History.prototype.pushState;
-  const nativeReplaceState = History.prototype.replaceState;
-  History.prototype.pushState = function(...args) {
-    const result = nativePushState.apply(this, args);
-    scheduleLocation();
-    return result;
-  };
-  History.prototype.replaceState = function(...args) {
-    const result = nativeReplaceState.apply(this, args);
-    scheduleLocation();
-    return result;
-  };
-
-  window.addEventListener('popstate', scheduleLocation);
-  window.addEventListener('hashchange', scheduleLocation);
-  window.addEventListener('pageshow', scheduleLocation);
-  document.addEventListener('click', (event) => {
-    if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
-    const anchor = event.target instanceof Element ? event.target.closest('a[href]') : null;
-    if (!anchor || anchor.hasAttribute('download')) return;
-    let url;
-    try { url = new URL(anchor.href, window.location.href); } catch { return; }
-    if (!loopbackHosts.has(url.hostname.toLowerCase()) || url.origin === window.location.origin) return;
-    event.preventDefault();
-    post({ type: 'navigate-loopback', href: url.toString(), newTab: anchor.target === '_blank' });
-  }, true);
-
-  window.addEventListener('message', (event) => {
-    const message = event.data;
-    if (!message || message.source !== hostSource) return;
-    if (message.action === 'back') window.history.back();
-    else if (message.action === 'forward') window.history.forward();
-    else if (message.action === 'reload') window.location.reload();
-    else if (message.action === 'stop') window.stop();
-  });
-
-  const heartbeat = () => fetch(${JSON.stringify(PREVIEW_HEARTBEAT_PATH)}, {
-    credentials: 'include',
-    cache: 'no-store',
-  }).catch(() => {});
-  window.setInterval(heartbeat, 30000);
-  heartbeat();
-  sendLocation();
-})();`;
 function nowIso(value) {
     return new Date(value).toISOString();
 }
-function cookieNameForWorkspace(workspaceId) {
-    const suffix = createHash('sha256').update(workspaceId).digest('hex').slice(0, 16);
-    return `agent-tower-preview-${suffix}`;
-}
 function newSecret() {
     return randomBytes(32).toString('base64url');
 }
@@ -85,46 +33,6 @@ function safeEqual(left, right) {
     const b = Buffer.from(right);
     return a.length === b.length && timingSafeEqual(a, b);
 }
-function parseCookies(header) {
-    const cookies = new Map();
-    if (!header)
-        return cookies;
-    for (const part of header.split(';')) {
-        const [rawName, ...rawValue] = part.trim().split('=');
-        if (!rawName)
-            continue;
-        try {
-            cookies.set(rawName, decodeURIComponent(rawValue.join('=')));
-        }
-        catch {
-            cookies.set(rawName, rawValue.join('='));
-        }
-    }
-    return cookies;
-}
-function firstHeaderValue(value) {
-    return Array.isArray(value) ? value[0] : value;
-}
-function requestProtocol(headers) {
-    const forwarded = firstHeaderValue(headers['x-forwarded-proto']);
-    if (forwarded?.split(',')[0]?.trim().toLowerCase() === 'https')
-        return 'https';
-    const cfVisitor = firstHeaderValue(headers['cf-visitor']);
-    if (cfVisitor) {
-        try {
-            if (JSON.parse(cfVisitor).scheme === 'https')
-                return 'https';
-        }
-        catch {
-            // Ignore malformed Cloudflare metadata.
-        }
-    }
-    return 'http';
-}
-function isRemoteGatewayRequest(headers) {
-    return Boolean(headers['cf-connecting-ip'] || headers['cf-ray'])
-        || requestProtocol(headers) === 'https';
-}
 function requestOrigin(headers) {
     const host = firstHeaderValue(headers.host)
         || firstHeaderValue(headers['x-forwarded-host'])?.split(',')[0]?.trim()
@@ -152,47 +60,6 @@ function removeQueryParameter(rawUrl, parameter) {
     url.searchParams.delete(parameter);
     return `${url.pathname}${url.search}${url.hash}`;
 }
-function scopedTargetCookieName(runtimeCookieName, targetCookieName) {
-    return `${runtimeCookieName}-target-${Buffer.from(targetCookieName).toString('base64url')}`;
-}
-function isInternalCookieName(name) {
-    return name === TUNNEL_SESSION_COOKIE_NAME || isAccessAuthCookieName(name);
-}
-function unscopedTargetCookieName(runtimeCookieName, cookieName) {
-    const prefix = `${runtimeCookieName}-target-`;
-    if (!cookieName.startsWith(prefix))
-        return null;
-    try {
-        const targetCookieName = Buffer.from(cookieName.slice(prefix.length), 'base64url').toString('utf8');
-        return isInternalCookieName(targetCookieName) ? targetCookieName : null;
-    }
-    catch {
-        return null;
-    }
-}
-function filterCookieHeader(cookieHeader, runtimeCookieName) {
-    if (!cookieHeader)
-        return undefined;
-    const cookies = [];
-    for (const rawPart of cookieHeader.split(';')) {
-        const part = rawPart.trim();
-        if (!part)
-            continue;
-        const separator = part.indexOf('=');
-        const name = separator === -1 ? part : part.slice(0, separator);
-        if (!name || name === runtimeCookieName)
-            continue;
-        const targetName = unscopedTargetCookieName(runtimeCookieName, name);
-        if (targetName) {
-            cookies.push(`${targetName}${separator === -1 ? '' : part.slice(separator)}`);
-            continue;
-        }
-        if (isInternalCookieName(name))
-            continue;
-        cookies.push(part);
-    }
-    return cookies.length > 0 ? cookies.join('; ') : undefined;
-}
 function joinTargetPath(target, requestUrl) {
     const parsed = new URL(requestUrl, 'http://preview.local');
     const suffix = parsed.pathname.startsWith('/') ? parsed.pathname : `/${parsed.pathname}`;
@@ -214,7 +81,7 @@ function rewriteRequestHeaders(headers, runtime, targetPath) {
         if (key.toLowerCase().startsWith('cf-'))
             delete next[key];
     }
-    const cookie = filterCookieHeader(headers.cookie, runtime.cookieName);
+    const cookie = filterTargetCookieHeader(headers.cookie, runtime.cookieName);
     if (cookie)
         next.cookie = cookie;
     else
@@ -247,41 +114,6 @@ function rewriteLocation(value, runtime, requestHeaders) {
         return value;
     }
 }
-export function rewriteTargetCookie(value, target, runtimeCookieName, secureGateway) {
-    let next = value.replace(/;\s*domain=[^;]*/gi, '');
-    const separator = next.indexOf('=');
-    if (separator > 0) {
-        const cookieName = next.slice(0, separator).trim();
-        if (isInternalCookieName(cookieName)) {
-            next = `${scopedTargetCookieName(runtimeCookieName, cookieName)}${next.slice(separator)}`;
-        }
-    }
-    if (target.basePath && /;\s*path=/i.test(next)) {
-        next = next.replace(/;\s*path=([^;]*)/i, (_match, rawPath) => {
-            const path = rawPath.trim();
-            if (path === target.basePath)
-                return '; Path=/';
-            if (path.startsWith(`${target.basePath}/`)) {
-                return `; Path=${path.slice(target.basePath.length) || '/'}`;
-            }
-            return `; Path=${path || '/'}`;
-        });
-    }
-    if (secureGateway) {
-        next = next
-            .replace(/;\s*secure(?=;|$)/gi, '')
-            .replace(/;\s*samesite=[^;]*/gi, '')
-            .replace(/;\s*partitioned(?=;|$)/gi, '');
-        return `${next}; Secure; SameSite=None; Partitioned`;
-    }
-    next = next
-        .replace(/;\s*secure(?=;|$)/gi, '')
-        .replace(/;\s*partitioned(?=;|$)/gi, '');
-    if (/;\s*samesite=none(?=;|$)/i.test(next)) {
-        next = next.replace(/;\s*samesite=none(?=;|$)/i, '; SameSite=Lax');
-    }
-    return next;
-}
 function rewriteResponseHeaders(headers, runtime, requestHeaders, injectBridge) {
     const next = {};
     for (const [key, value] of Object.entries(headers)) {
@@ -313,14 +145,16 @@ function isHtmlResponse(headers) {
     const contentType = firstHeaderValue(headers['content-type'])?.toLowerCase() ?? '';
     return contentType.includes('text/html');
 }
-function injectBridgeScript(body) {
-    if (body.includes('data-agent-tower-preview-bridge'))
-        return body;
-    const script = `<script data-agent-tower-preview-bridge src="${PREVIEW_BRIDGE_PATH}"></script>`;
-    const head = /<head(?:\s[^>]*)?>/i;
-    if (head.test(body))
-        return body.replace(head, (match) => `${match}${script}`);
-    return `${script}${body}`;
+function gatewayBridgeTag(runtime) {
+    return buildPreviewBridgeScript({
+        mode: 'gateway',
+        prefix: '',
+        workspaceId: runtime.workspaceId,
+        targetOrigin: runtime.target.origin,
+        targetBasePath: runtime.target.basePath,
+        serviceWorker: false,
+        heartbeatPath: PREVIEW_HEARTBEAT_PATH,
+    });
 }
 function writeUnauthorized(response) {
     response.writeHead(401, {
@@ -381,18 +215,12 @@ export class PreviewRuntimeManager {
     leaseTtlMs;
     listenHost;
     now;
-    createTunnel;
-    ensureTunnelBinary;
     sweepTimer;
     constructor(options = {}) {
         this.idleTtlMs = options.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
         this.listenHost = options.listenHost ?? process.env.AGENT_TOWER_HOST ?? '0.0.0.0';
         this.now = options.now ?? (() => Date.now());
-        this.createTunnel = options.createTunnel
-            ?? ((targetUrl) => Tunnel.quick(targetUrl, QUICK_TUNNEL_OPTIONS));
-        this.ensureTunnelBinary = options.ensureTunnelBinary
-            ?? (options.createTunnel ? async () => { } : ensureCloudflaredBinary);
         this.sweepTimer = setInterval(() => {
             void this.sweep().catch((error) => {
                 writeErrorLog({ level: 'error', source: 'preview.cleanup', message: 'Failed to reclaim preview runtime', error });
@@ -400,25 +228,18 @@ export class PreviewRuntimeManager {
         }, options.sweepIntervalMs ?? DEFAULT_SWEEP_INTERVAL_MS);
         this.sweepTimer.unref?.();
     }
-    async acquire(workspaceId, target, mode, localHostname) {
+    async acquire(workspaceId, target, localHostname) {
         const runtime = await this.ensureRuntime(workspaceId, target);
         this.assertRuntimeActive(runtime);
         const now = this.now();
         const lease = {
             id: randomBytes(16).toString('base64url'),
-            mode,
             localHostname,
             expiresAtMs: now + this.leaseTtlMs,
         };
         runtime.leases.set(lease.id, lease);
         runtime.lastActivityAtMs = now;
-        if (mode === 'remote')
-            runtime.tunnelLastActivityAtMs = now;
-        const viewBaseUrl = mode === 'remote'
-            ? await this.ensureTunnel(runtime)
-            : `http://${formatHostname(localHostname)}:${runtime.port}`;
-        this.assertRuntimeActive(runtime);
-        return this.toSession(runtime, lease, viewBaseUrl);
+        return this.toSession(runtime, lease);
     }
     async heartbeat(workspaceId, leaseId) {
         const runtime = this.runtimes.get(workspaceId);
@@ -428,13 +249,8 @@ export class PreviewRuntimeManager {
         const now = this.now();
         lease.expiresAtMs = now + this.leaseTtlMs;
         runtime.lastActivityAtMs = now;
-        if (lease.mode === 'remote')
-            runtime.tunnelLastActivityAtMs = now;
-        const viewBaseUrl = lease.mode === 'remote'
-            ? await this.ensureTunnel(runtime)
-            : `http://${formatHostname(lease.localHostname)}:${runtime.port}`;
         this.assertRuntimeActive(runtime);
-        return this.toSession(runtime, lease, viewBaseUrl);
+        return this.toSession(runtime, lease);
     }
     release(workspaceId, leaseId) {
         this.runtimes.get(workspaceId)?.leases.delete(leaseId);
@@ -443,7 +259,7 @@ export class PreviewRuntimeManager {
         const runtime = this.runtimes.get(workspaceId);
         if (!runtime)
             return;
-        await this.stopRuntime(runtime);
+        await closeServer(runtime);
         if (this.runtimes.get(workspaceId) === runtime)
             this.runtimes.delete(workspaceId);
     }
@@ -455,13 +271,12 @@ export class PreviewRuntimeManager {
         if (failure)
             throw failure.reason;
     }
-    toSession(runtime, lease, viewBaseUrl) {
+    toSession(runtime, lease) {
         return {
             id: lease.id,
             workspaceId: runtime.workspaceId,
             target: runtime.target.target,
-            mode: lease.mode,
-            viewBaseUrl,
+            viewBaseUrl: `http://${formatHostname(lease.localHostname)}:${runtime.port}`,
             expiresAt: nowIso(lease.expiresAtMs),
         };
     }
@@ -492,19 +307,13 @@ export class PreviewRuntimeManager {
             server,
             port: 0,
             ready: Promise.resolve(0),
-            cookieName: cookieNameForWorkspace(workspaceId),
+            cookieName: previewCookieScopeName(workspaceId),
             accessSecret: newSecret(),
             accessGeneration: AccessAuthService.getSessionSecretGeneration(),
             leases: new Map(),
             lastActivityAtMs: this.now(),
-            tunnelLastActivityAtMs: this.now(),
             activeConnections: 0,
-            activeRemoteConnections: 0,
             sockets: new Set(),
-            tunnel: null,
-            tunnelUrl: null,
-            tunnelStartPromise: null,
-            tunnelStartController: null,
             stopped: false,
         });
         server.on('connection', (socket) => {
@@ -526,7 +335,7 @@ export class PreviewRuntimeManager {
             return runtime;
         }
         catch (error) {
-            await this.stopRuntime(runtime);
+            await closeServer(runtime);
             if (this.runtimes.get(workspaceId) === runtime)
                 this.runtimes.delete(workspaceId);
             throw error;
@@ -541,14 +350,11 @@ export class PreviewRuntimeManager {
     }
     hasGatewayCookie(runtime, request) {
         this.rotateAccessSecretIfNeeded(runtime);
-        const candidate = parseCookies(request.headers.cookie).get(runtime.cookieName);
+        const candidate = parseCookieHeader(request.headers.cookie).get(runtime.cookieName);
         return Boolean(candidate && safeEqual(candidate, runtime.accessSecret));
     }
-    touchRuntime(runtime, headers) {
-        const now = this.now();
-        runtime.lastActivityAtMs = now;
-        if (isRemoteGatewayRequest(headers))
-            runtime.tunnelLastActivityAtMs = now;
+    touchRuntime(runtime) {
+        runtime.lastActivityAtMs = this.now();
     }
     async authorizeBootstrap(runtime, request, response) {
         const parsed = new URL(request.url ?? '/', 'http://preview.local');
@@ -557,7 +363,7 @@ export class PreviewRuntimeManager {
             return false;
         }
         this.rotateAccessSecretIfNeeded(runtime);
-        this.touchRuntime(runtime, request.headers);
+        this.touchRuntime(runtime);
         response.setHeader('set-cookie', serializeGatewayCookie(runtime, request.headers));
         if (request.method === 'GET' || request.method === 'HEAD') {
             response.writeHead(302, {
@@ -585,15 +391,7 @@ export class PreviewRuntimeManager {
             writeUnauthorized(response);
             return;
         }
-        this.touchRuntime(runtime, request.headers);
-        if (parsed.pathname === PREVIEW_BRIDGE_PATH) {
-            response.writeHead(200, {
-                'content-type': 'application/javascript; charset=utf-8',
-                'cache-control': 'no-store',
-            });
-            response.end(PREVIEW_BRIDGE_SCRIPT);
-            return;
-        }
+        this.touchRuntime(runtime);
         if (parsed.pathname === PREVIEW_HEARTBEAT_PATH) {
             response.writeHead(204, { 'cache-control': 'no-store' });
             response.end();
@@ -604,6 +402,7 @@ export class PreviewRuntimeManager {
     async proxyHttpRequest(runtime, request, response) {
         const targetUrl = new URL(runtime.target.origin);
         const targetPath = joinTargetPath(runtime.target, request.url ?? '/');
+        const context = classifyPreviewRequest(request.method ?? 'GET', request.headers, new URL(request.url ?? '/', 'http://preview.local').search);
         const options = {
             protocol: targetUrl.protocol,
             hostname: targetUrl.hostname,
@@ -619,6 +418,7 @@ export class PreviewRuntimeManager {
                 const injectBridge = request.method !== 'HEAD'
                     && proxyResponse.statusCode !== 204
                     && proxyResponse.statusCode !== 304
+                    && context.document
                     && isHtmlResponse(proxyResponse.headers);
                 const headers = rewriteResponseHeaders(proxyResponse.headers, runtime, request.headers, injectBridge);
                 response.statusCode = proxyResponse.statusCode ?? 502;
@@ -640,7 +440,7 @@ export class PreviewRuntimeManager {
                     chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
                 });
                 proxyResponse.once('end', () => {
-                    response.end(injectBridgeScript(Buffer.concat(chunks).toString('utf8')));
+                    response.end(injectPreviewBridge(Buffer.concat(chunks), gatewayBridgeTag(runtime)));
                     resolve();
                 });
                 proxyResponse.once('error', () => {
@@ -663,8 +463,7 @@ export class PreviewRuntimeManager {
             writeUpgradeError(socket, 401, 'Unauthorized');
             return;
         }
-        this.touchRuntime(runtime, request.headers);
-        const remoteConnection = isRemoteGatewayRequest(request.headers);
+        this.touchRuntime(runtime);
         const targetUrl = new URL(runtime.target.origin);
         const targetPath = joinTargetPath(runtime.target, request.url ?? '/');
         const headers = rewriteRequestHeaders(request.headers, runtime, targetPath);
@@ -683,24 +482,15 @@ export class PreviewRuntimeManager {
         const proxyRequest = transport.request(options);
         proxyRequest.once('upgrade', (proxyResponse, proxySocket, proxyHead) => {
             runtime.activeConnections += 1;
-            if (remoteConnection)
-                runtime.activeRemoteConnections += 1;
             runtime.sockets.add(proxySocket);
             const close = () => {
                 runtime.activeConnections = Math.max(0, runtime.activeConnections - 1);
-                if (remoteConnection) {
-                    runtime.activeRemoteConnections = Math.max(0, runtime.activeRemoteConnections - 1);
-                }
                 runtime.sockets.delete(proxySocket);
-                this.touchRuntime(runtime, request.headers);
+                this.touchRuntime(runtime);
             };
             proxySocket.once('close', close);
-            proxySocket.on('data', () => {
-                this.touchRuntime(runtime, request.headers);
-            });
-            socket.on('data', () => {
-                this.touchRuntime(runtime, request.headers);
-            });
+            proxySocket.on('data', () => this.touchRuntime(runtime));
+            socket.on('data', () => this.touchRuntime(runtime));
             const headerLines = [
                 `HTTP/1.1 ${proxyResponse.statusCode} ${proxyResponse.statusMessage}`,
                 ...Object.entries(proxyResponse.headers).flatMap(([key, value]) => {
@@ -730,88 +520,6 @@ export class PreviewRuntimeManager {
             throw new Error('Preview runtime was invalidated');
         }
     }
-    async ensureTunnel(runtime) {
-        this.assertRuntimeActive(runtime);
-        if (runtime.tunnel && runtime.tunnelUrl)
-            return runtime.tunnelUrl;
-        if (runtime.tunnelStartPromise)
-            return runtime.tunnelStartPromise;
-        if (runtime.tunnel)
-            throw new Error('Previous preview tunnel cleanup must finish before starting');
-        const controller = new AbortController();
-        runtime.tunnelStartController = controller;
-        let startedTunnel = null;
-        const startPromise = (async () => {
-            await waitForTunnelBinary(this.ensureTunnelBinary(), controller.signal);
-            this.assertRuntimeActive(runtime);
-            return new Promise((resolve, reject) => {
-                const tunnel = this.createTunnel(`http://127.0.0.1:${runtime.port}`);
-                startedTunnel = tunnel;
-                trackCloudflaredTunnel(tunnel);
-                runtime.tunnel = tunnel;
-                let settled = false;
-                const timer = setTimeout(() => settle(reject, new Error('Preview tunnel startup timed out')), TUNNEL_STARTUP_TIMEOUT_MS);
-                const cleanup = () => {
-                    clearTimeout(timer);
-                    tunnel.off('url', onUrl);
-                    tunnel.off('error', onError);
-                    tunnel.off('exit', onExitBeforeReady);
-                    controller.signal.removeEventListener('abort', onAbort);
-                };
-                const settle = (done, value) => {
-                    if (settled)
-                        return;
-                    settled = true;
-                    cleanup();
-                    done(value);
-                };
-                const onAbort = () => settle(reject, controller.signal.reason);
-                const onUrl = (url) => {
-                    runtime.tunnelUrl = url.replace(/\/$/, '');
-                    settle(resolve, runtime.tunnelUrl);
-                };
-                const onError = (error) => settle(reject, error);
-                const onExitBeforeReady = (code, signal) => {
-                    settle(reject, new Error(`Preview tunnel exited before ready (${code ?? signal ?? 'unknown'})`));
-                };
-                controller.signal.addEventListener('abort', onAbort, { once: true });
-                tunnel.once('url', onUrl);
-                tunnel.once('error', onError);
-                tunnel.once('exit', onExitBeforeReady);
-                tunnel.on('error', () => {
-                    // The session heartbeat will recreate a failed tunnel when needed.
-                });
-                tunnel.on('exit', () => {
-                    if (runtime.tunnel !== tunnel)
-                        return;
-                    runtime.tunnel = null;
-                    runtime.tunnelUrl = null;
-                });
-            });
-        })();
-        runtime.tunnelStartPromise = startPromise;
-        try {
-            const url = await startPromise;
-            controller.signal.throwIfAborted();
-            this.assertRuntimeActive(runtime);
-            return url;
-        }
-        catch (error) {
-            if (startedTunnel) {
-                await stopCloudflaredTunnel(startedTunnel);
-                if (runtime.tunnel === startedTunnel)
-                    runtime.tunnel = null;
-            }
-            runtime.tunnelUrl = null;
-            throw error;
-        }
-        finally {
-            if (runtime.tunnelStartPromise === startPromise) {
-                runtime.tunnelStartPromise = null;
-                runtime.tunnelStartController = null;
-            }
-        }
-    }
     async sweep() {
         const now = this.now();
         const expired = [];
@@ -820,13 +528,6 @@ export class PreviewRuntimeManager {
                 if (lease.expiresAtMs <= now)
                     runtime.leases.delete(leaseId);
             }
-            const hasRemoteLease = [...runtime.leases.values()].some((lease) => lease.mode === 'remote');
-            if (runtime.tunnel
-                && !hasRemoteLease
-                && runtime.activeRemoteConnections === 0
-                && now - runtime.tunnelLastActivityAtMs >= this.idleTtlMs) {
-                await this.stopTunnel(runtime);
-            }
             if (runtime.leases.size === 0
                 && runtime.activeConnections === 0
                 && now - runtime.lastActivityAtMs >= this.idleTtlMs) {
@@ -839,23 +540,5 @@ export class PreviewRuntimeManager {
             await this.invalidate(runtime.workspaceId);
         }));
     }
-    async stopRuntime(runtime) {
-        runtime.stopped = true;
-        const results = await Promise.allSettled([this.stopTunnel(runtime), closeServer(runtime)]);
-        const failure = results.find((result) => result.status === 'rejected');
-        if (failure)
-            throw failure.reason;
-    }
-    async stopTunnel(runtime) {
-        runtime.tunnelStartController?.abort(new Error('Preview tunnel startup cancelled'));
-        runtime.tunnelUrl = null;
-        await runtime.tunnelStartPromise?.catch(() => undefined);
-        const tunnel = runtime.tunnel;
-        if (tunnel) {
-            await stopCloudflaredTunnel(tunnel);
-            if (runtime.tunnel === tunnel)
-                runtime.tunnel = null;
-        }
-    }
 }
 //# sourceMappingURL=preview-runtime-manager.js.map