agentroam 0.2.0-preview.2 → 0.2.0-preview.4

package/dist/tunnel/child-process.js

@@ -0,0 +1,23 @@
+export async function stopChildProcess(child, timeoutMs = 3_000) {
+    if (child.exitCode !== null || !child.pid)
+        return;
+    const exited = new Promise((resolvePromise) => child.once("exit", () => resolvePromise()));
+    signal(child, "SIGTERM");
+    await Promise.race([exited, new Promise((resolvePromise) => setTimeout(resolvePromise, timeoutMs))]);
+    if (child.exitCode === null)
+        signal(child, "SIGKILL");
+}
+function signal(child, name) {
+    try {
+        if (process.platform !== "win32" && child.pid)
+            process.kill(-child.pid, name);
+        else
+            child.kill(name);
+    }
+    catch {
+        try {
+            child.kill(name);
+        }
+        catch { }
+    }
+}

package/dist/tunnel/cloudflare-provider.js

@@ -1,15 +1,66 @@
 import { spawn } from "node:child_process";
+import { stopChildProcess } from "./child-process.js";
 export class CloudflareTunnelProvider {
     executable;
     constructor(executable) {
         this.executable = executable;
     }
-    async start({ localUrl, signal, log }) { const child = spawn(this.executable, ["tunnel", "--no-autoupdate", "--url", localUrl], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true }); const publicUrl = await waitForUrl(child, log, 30000); signal.addEventListener("abort", () => child.kill(), { once: true }); const exited = new Promise(resolve => child.once("exit", (code, sig) => resolve({ code, signal: sig }))); return { publicUrl, exited, close: async () => { if (child.exitCode === null)
-            child.kill(); await Promise.race([exited, new Promise(resolve => setTimeout(resolve, 3000))]); } }; }
+    async start({ localUrl, signal, log }) {
+        const child = spawn(this.executable, ["tunnel", "--no-autoupdate", "--url", localUrl], {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        const abort = () => void stopChildProcess(child);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
+        try {
+            const publicUrl = await waitForConnectedUrl(child, log, 30_000);
+            const exited = new Promise((resolvePromise) => child.once("exit", (code, childSignal) => resolvePromise({ code, signal: childSignal })));
+            return { publicUrl, exited, close: () => stopChildProcess(child) };
+        }
+        catch (error) {
+            await stopChildProcess(child);
+            throw error;
+        }
+    }
+}
+export function waitForConnectedUrl(child, log, timeoutMs) {
+    return new Promise((resolvePromise, reject) => {
+        const buffers = { stdout: "", stderr: "" };
+        let publicUrl = null;
+        let connected = false;
+        let settled = false;
+        const finish = (error, url) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolvePromise(url);
+        };
+        const timer = setTimeout(() => finish(new Error("cloudflared tunnel connection timeout")), timeoutMs);
+        const read = (stream) => (chunk) => {
+            const text = chunk.toString();
+            const buffer = (buffers[stream] + text).slice(-8192);
+            buffers[stream] = buffer;
+            for (const line of text.split(/\r?\n/))
+                if (line)
+                    log(line.replace(/pair=[^\s&]+/g, "pair=[REDACTED]"));
+            const match = buffer.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i);
+            if (match)
+                publicUrl = match[0];
+            if (/Registered tunnel connection/i.test(buffer))
+                connected = true;
+            if (publicUrl && connected)
+                finish(undefined, publicUrl);
+        };
+        child.stdout?.on("data", read("stdout"));
+        child.stderr?.on("data", read("stderr"));
+        child.once("exit", (code) => finish(new Error(`cloudflared exited before tunnel became ready (${code})`)));
+        child.once("error", (error) => finish(error));
+    });
 }
-async function waitForUrl(child, log, timeoutMs) { return new Promise((resolve, reject) => { let buffer = ""; const timer = setTimeout(() => reject(new Error("cloudflared tunnel URL timeout")), timeoutMs); const read = (chunk) => { const text = chunk.toString(); buffer = (buffer + text).slice(-8192); for (const line of text.split(/\r?\n/))
-    if (line)
-        log(line.replace(/pair=[^\s&]+/g, "pair=[REDACTED]")); const match = buffer.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i); if (match) {
-    clearTimeout(timer);
-    resolve(match[0]);
-} }; child.stdout?.on("data", read); child.stderr?.on("data", read); child.once("exit", code => { clearTimeout(timer); reject(new Error(`cloudflared exited before URL (${code})`)); }); child.once("error", reject); }); }

package/dist/tunnel/cloudflare-provider.test.js

@@ -0,0 +1,33 @@
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import { describe, expect, it, vi } from "vitest";
+import { waitForConnectedUrl } from "./cloudflare-provider.js";
+describe("waitForConnectedUrl", () => {
+    it("waits for both the public URL and a registered tunnel connection", async () => {
+        const { child, stderr } = fakeChild();
+        let resolved = false;
+        const ready = waitForConnectedUrl(child, vi.fn(), 100).then((url) => {
+            resolved = true;
+            return url;
+        });
+        stderr.write("https://ready.trycloudflare.com\n");
+        await new Promise((resolvePromise) => setImmediate(resolvePromise));
+        expect(resolved).toBe(false);
+        stderr.write("INF Registered tunnel ");
+        stderr.write("connection connIndex=0 protocol=quic\n");
+        await expect(ready).resolves.toBe("https://ready.trycloudflare.com");
+    });
+    it("supports registration output arriving before the URL", async () => {
+        const { child, stdout, stderr } = fakeChild();
+        const ready = waitForConnectedUrl(child, vi.fn(), 100);
+        stdout.write("INF Registered tunnel connection connIndex=0 protocol=http2\n");
+        stderr.write("Visit https://later.trycloudflare.com when ready\n");
+        await expect(ready).resolves.toBe("https://later.trycloudflare.com");
+    });
+});
+function fakeChild() {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    const child = Object.assign(new EventEmitter(), { stdout, stderr });
+    return { child, stdout, stderr };
+}

package/dist/tunnel/custom-command-provider.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { stopChildProcess } from "./child-process.js";
 export class CustomCommandTunnelProvider {
     command;
     port;
@@ -6,8 +7,57 @@ export class CustomCommandTunnelProvider {
         this.command = command;
         this.port = port;
     }
-    async start({ signal, log }) { const rendered = this.command.replaceAll("{port}", String(this.port)); const child = spawn(rendered, { shell: true, stdio: ["ignore", "pipe", "pipe"], windowsHide: true }); const publicUrl = await new Promise((resolve, reject) => { let buffer = ""; const timer = setTimeout(() => reject(new Error("custom tunnel URL timeout")), 30000); const read = (chunk) => { const text = chunk.toString(); buffer = (buffer + text).slice(-8192); log(text.trim()); const match = buffer.match(/https:\/\/[^\s]+/i); if (match) {
-        clearTimeout(timer);
-        resolve(match[0].replace(/[),.;]+$/, ""));
-    } }; child.stdout?.on("data", read); child.stderr?.on("data", read); child.once("error", reject); }); signal.addEventListener("abort", () => child.kill(), { once: true }); const exited = new Promise(resolve => child.once("exit", (code, sig) => resolve({ code, signal: sig }))); return { publicUrl, exited, close: async () => { child.kill(); } }; }
+    async start({ signal, log }) {
+        const rendered = this.command.replaceAll("{port}", String(this.port));
+        const child = spawn(rendered, {
+            shell: true,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        const abort = () => void stopChildProcess(child);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
+        try {
+            const publicUrl = await waitForCustomUrl(child, log, 30_000);
+            const exited = new Promise((resolvePromise) => child.once("exit", (code, childSignal) => resolvePromise({ code, signal: childSignal })));
+            return { publicUrl, exited, close: () => stopChildProcess(child) };
+        }
+        catch (error) {
+            await stopChildProcess(child);
+            throw error;
+        }
+    }
+}
+function waitForCustomUrl(child, log, timeoutMs) {
+    return new Promise((resolvePromise, reject) => {
+        let buffer = "";
+        let settled = false;
+        const finish = (error, url) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolvePromise(url);
+        };
+        const timer = setTimeout(() => finish(new Error("custom tunnel URL timeout")), timeoutMs);
+        const read = (chunk) => {
+            const text = chunk.toString();
+            buffer = (buffer + text).slice(-8192);
+            for (const line of text.split(/\r?\n/))
+                if (line)
+                    log(line.replace(/pair=[^\s&]+/g, "pair=[REDACTED]"));
+            const match = buffer.match(/https:\/\/[^\s]+/i);
+            if (match)
+                finish(undefined, match[0].replace(/[),.;]+$/, ""));
+        };
+        child.stdout?.on("data", read);
+        child.stderr?.on("data", read);
+        child.once("error", (error) => finish(error));
+        child.once("exit", (code) => finish(new Error(`custom tunnel exited before URL (${code})`)));
+    });
 }

package/dist/tunnel/pinggy-provider.js

@@ -0,0 +1,84 @@
+import { spawn } from "node:child_process";
+import { mkdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import { stopChildProcess } from "./child-process.js";
+export class PinggyTunnelProvider {
+    port;
+    dataDir;
+    spawnImpl;
+    constructor(port, dataDir, spawnImpl = spawn) {
+        this.port = port;
+        this.dataDir = dataDir;
+        this.spawnImpl = spawnImpl;
+    }
+    async start({ signal, log }) {
+        const sshDir = resolve(this.dataDir, "ssh");
+        await mkdir(sshDir, { recursive: true });
+        const knownHosts = resolve(sshDir, "known_hosts");
+        const args = [
+            "-p", "443",
+            "-o", "ExitOnForwardFailure=yes",
+            "-o", "ServerAliveInterval=30",
+            "-o", "ServerAliveCountMax=3",
+            "-o", "StrictHostKeyChecking=accept-new",
+            "-o", `UserKnownHostsFile=${knownHosts}`,
+            "-R", `0:localhost:${this.port}`,
+            "free.pinggy.io",
+        ];
+        const child = this.spawnImpl("ssh", args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        const abort = () => void stopChildProcess(child);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
+        try {
+            const publicUrl = await waitForPinggyUrl(child, log, 30_000);
+            const exited = new Promise((resolvePromise) => child.once("exit", (code, childSignal) => resolvePromise({ code, signal: childSignal })));
+            return { publicUrl, exited, close: () => stopChildProcess(child) };
+        }
+        catch (error) {
+            await stopChildProcess(child);
+            throw error;
+        }
+    }
+}
+export function parsePinggyUrl(text) {
+    return text.match(/https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)*\.pinggy-free\.link/i)?.[0] ?? null;
+}
+function waitForPinggyUrl(child, log, timeoutMs) {
+    return new Promise((resolvePromise, reject) => {
+        let buffer = "";
+        let settled = false;
+        const finish = (error, url) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolvePromise(url);
+        };
+        const timer = setTimeout(() => finish(new Error("Pinggy tunnel URL timeout")), timeoutMs);
+        const read = (chunk) => {
+            const text = chunk.toString();
+            buffer = (buffer + text).slice(-16_384);
+            for (const line of text.split(/\r?\n/))
+                if (line)
+                    log(redact(line));
+            const url = parsePinggyUrl(buffer);
+            if (url)
+                finish(undefined, url);
+        };
+        child.stdout?.on("data", read);
+        child.stderr?.on("data", read);
+        child.once("error", (error) => finish(error));
+        child.once("exit", (code) => finish(new Error(`Pinggy SSH exited before URL (${code})`)));
+    });
+}
+function redact(text) {
+    return text.replace(/pair=[^\s&]+/g, "pair=[REDACTED]");
+}

package/dist/tunnel/pinggy-provider.test.js

@@ -0,0 +1,40 @@
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import { describe, expect, it, vi } from "vitest";
+import { PinggyTunnelProvider, parsePinggyUrl } from "./pinggy-provider.js";
+describe("parsePinggyUrl", () => {
+    it("accepts only Pinggy free HTTPS URLs", () => {
+        expect(parsePinggyUrl("open https://abc-123.run.pinggy-free.link now")).toBe("https://abc-123.run.pinggy-free.link");
+        expect(parsePinggyUrl("https://example.com")).toBeNull();
+        expect(parsePinggyUrl("http://abc.run.pinggy-free.link")).toBeNull();
+    });
+});
+describe("PinggyTunnelProvider", () => {
+    it("starts SSH on port 443 with persistent host-key checking", async () => {
+        const child = fakeChild();
+        const spawnImpl = vi.fn((_command, _args) => child);
+        const provider = new PinggyTunnelProvider(43210, "/tmp/agentroam-test", spawnImpl);
+        const started = provider.start({ localUrl: "http://127.0.0.1:43210", signal: new AbortController().signal, log: vi.fn() });
+        queueMicrotask(() => child.stderr.write("https://sample.run.pinggy-free.link\n"));
+        const handle = await started;
+        expect(handle.publicUrl).toBe("https://sample.run.pinggy-free.link");
+        const args = spawnImpl.mock.calls[0][1];
+        expect(args).toContain("443");
+        expect(args).toContain("StrictHostKeyChecking=accept-new");
+        expect(args).toContain("0:localhost:43210");
+        expect(args.some((value) => value.startsWith("UserKnownHostsFile="))).toBe(true);
+    });
+});
+function fakeChild() {
+    const child = new EventEmitter();
+    child.stdout = new PassThrough();
+    child.stderr = new PassThrough();
+    Object.defineProperty(child, "exitCode", { value: null, writable: true });
+    Object.defineProperty(child, "pid", { value: undefined, writable: true });
+    child.kill = vi.fn(() => {
+        child.exitCode = 0;
+        child.emit("exit", 0, null);
+        return true;
+    });
+    return child;
+}

package/dist/tunnel/proxy-settings.js

@@ -0,0 +1,141 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function resolveProxyForUrl(target, options = {}) {
+    const env = options.env ?? process.env;
+    const noProxy = env.no_proxy?.trim() ? env.no_proxy : env.NO_PROXY;
+    if (matchesNoProxy(target, noProxy))
+        return null;
+    const environmentProxy = selectEnvironmentProxy(target.protocol, env);
+    if (environmentProxy !== null)
+        return normalizeProxyUrl(environmentProxy);
+    if ((options.platform ?? process.platform) !== "darwin")
+        return null;
+    try {
+        const output = await (options.readMacSystemProxy ?? readMacSystemProxy)();
+        const settings = parseMacSystemProxy(output);
+        if (target.protocol === "https:")
+            return settings.httpsProxy ?? settings.httpProxy;
+        if (target.protocol === "http:")
+            return settings.httpProxy;
+    }
+    catch {
+        // Proxy discovery is best-effort; direct readiness retains the previous behavior.
+    }
+    return null;
+}
+export function parseMacSystemProxy(output) {
+    const values = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^\s*([A-Za-z][A-Za-z0-9]*)\s*:\s*(.*?)\s*$/.exec(line);
+        if (match)
+            values.set(match[1], match[2]);
+    }
+    return {
+        httpProxy: buildMacProxy(values, "HTTP"),
+        httpsProxy: buildMacProxy(values, "HTTPS"),
+    };
+}
+async function readMacSystemProxy() {
+    const { stdout } = await execFileAsync("/usr/sbin/scutil", ["--proxy"], {
+        encoding: "utf8",
+        timeout: 2_000,
+    });
+    return stdout;
+}
+function selectEnvironmentProxy(protocol, env) {
+    const candidates = protocol === "https:"
+        ? [env.https_proxy, env.HTTPS_PROXY, env.http_proxy, env.HTTP_PROXY, env.all_proxy, env.ALL_PROXY]
+        : protocol === "http:"
+            ? [env.http_proxy, env.HTTP_PROXY, env.all_proxy, env.ALL_PROXY]
+            : [env.all_proxy, env.ALL_PROXY];
+    for (const candidate of candidates) {
+        if (candidate !== undefined && candidate.trim() !== "")
+            return candidate;
+    }
+    return null;
+}
+function normalizeProxyUrl(value) {
+    const candidate = value.trim();
+    try {
+        const proxy = new URL(candidate.includes("://") ? candidate : `http://${candidate}`);
+        if (!["http:", "https:"].includes(proxy.protocol) || proxy.hostname === "")
+            return null;
+        return proxy.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function buildMacProxy(values, prefix) {
+    if (values.get(`${prefix}Enable`) !== "1")
+        return null;
+    const host = values.get(`${prefix}Proxy`)?.trim();
+    const portText = values.get(`${prefix}Port`)?.trim();
+    const port = portText === undefined ? Number.NaN : Number(portText);
+    if (!host || /[\s\/?#@]/.test(host) || !Number.isInteger(port) || port < 1 || port > 65_535)
+        return null;
+    const formattedHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    return normalizeProxyUrl(`http://${formattedHost}:${port}`);
+}
+function matchesNoProxy(target, value) {
+    if (!value)
+        return false;
+    const hostname = normalizeHostname(target.hostname);
+    const targetPort = target.port || defaultPort(target.protocol);
+    for (const entry of value.split(",")) {
+        const rule = parseNoProxyRule(entry);
+        if (!rule)
+            continue;
+        if (rule.host === "*")
+            return true;
+        if (rule.port !== null && rule.port !== targetPort)
+            continue;
+        if (hostname === rule.host || hostname.endsWith(`.${rule.host}`))
+            return true;
+    }
+    return false;
+}
+function parseNoProxyRule(entry) {
+    let value = entry.trim().toLowerCase();
+    if (!value)
+        return null;
+    if (value === "*")
+        return { host: "*", port: null };
+    let host = value;
+    let port = null;
+    if (value.startsWith("[")) {
+        const closingBracket = value.indexOf("]");
+        if (closingBracket < 0)
+            return null;
+        host = value.slice(1, closingBracket);
+        const remainder = value.slice(closingBracket + 1);
+        if (remainder) {
+            if (!/^:\d+$/.test(remainder))
+                return null;
+            port = remainder.slice(1);
+        }
+    }
+    else {
+        const colon = value.lastIndexOf(":");
+        if (colon >= 0 && value.indexOf(":") === colon) {
+            const possiblePort = value.slice(colon + 1);
+            if (/^\d+$/.test(possiblePort)) {
+                host = value.slice(0, colon);
+                port = possiblePort;
+            }
+        }
+    }
+    host = normalizeHostname(host.replace(/^\*?\./, ""));
+    return host ? { host, port } : null;
+}
+function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function defaultPort(protocol) {
+    if (protocol === "https:")
+        return "443";
+    if (protocol === "http:")
+        return "80";
+    return "";
+}

package/dist/tunnel/proxy-settings.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from "vitest";
+import { parseMacSystemProxy, resolveProxyForUrl } from "./proxy-settings.js";
+const target = new URL("https://api.example.test/status");
+describe("resolveProxyForUrl", () => {
+    it("prefers the lowercase HTTPS proxy and normalizes an omitted scheme", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {
+                https_proxy: "127.0.0.1:7897",
+                HTTPS_PROXY: "http://uppercase.test:8080",
+                HTTP_PROXY: "http://http.test:8080",
+            },
+            platform: "linux",
+        })).resolves.toBe("http://127.0.0.1:7897/");
+    });
+    it("uses HTTP_PROXY as the HTTPS fallback and ALL_PROXY for HTTP", async () => {
+        await expect(resolveProxyForUrl(target, { env: { HTTP_PROXY: "http://http.test:8080" }, platform: "linux" })).resolves.toBe("http://http.test:8080/");
+        await expect(resolveProxyForUrl(new URL("http://example.test"), {
+            env: { ALL_PROXY: "https://all.test:8443" },
+            platform: "linux",
+        })).resolves.toBe("https://all.test:8443/");
+    });
+    it.each([
+        ["*", "https://api.example.test/status"],
+        ["api.example.test", "https://api.example.test/status"],
+        [".example.test", "https://api.example.test/status"],
+        ["example.test", "https://api.example.test/status"],
+        ["api.example.test:443", "https://api.example.test/status"],
+        ["api.example.test:8443", "https://api.example.test:8443/status"],
+    ])("bypasses the proxy for NO_PROXY=%s", async (noProxy, url) => {
+        await expect(resolveProxyForUrl(new URL(url), {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", NO_PROXY: noProxy },
+            platform: "darwin",
+            readMacSystemProxy: vi.fn(async () => macProxyOutput()),
+        })).resolves.toBeNull();
+    });
+    it("does not bypass a suffix lookalike or a rule with a different port", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", no_proxy: "notexample.test,api.example.test:8443" },
+            platform: "linux",
+        })).resolves.toBe("http://proxy.test:8080/");
+    });
+    it("falls back to uppercase NO_PROXY when the lowercase value is empty", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", no_proxy: "", NO_PROXY: "example.test" },
+            platform: "linux",
+        })).resolves.toBeNull();
+    });
+    it("falls back to the enabled macOS HTTPS proxy", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => macProxyOutput(),
+        })).resolves.toBe("http://127.0.0.1:7897/");
+    });
+    it("uses the macOS HTTP proxy when HTTPS proxying is disabled", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => macProxyOutput({ httpsEnabled: false }),
+        })).resolves.toBe("http://127.0.0.1:7898/");
+    });
+    it("returns direct mode for command failures and non-macOS platforms", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => {
+                throw new Error("scutil failed");
+            },
+        })).resolves.toBeNull();
+        const reader = vi.fn(async () => macProxyOutput());
+        await expect(resolveProxyForUrl(target, { env: {}, platform: "linux", readMacSystemProxy: reader })).resolves.toBeNull();
+        expect(reader).not.toHaveBeenCalled();
+    });
+});
+describe("parseMacSystemProxy", () => {
+    it("parses enabled HTTP and HTTPS settings", () => {
+        expect(parseMacSystemProxy(macProxyOutput())).toEqual({
+            httpProxy: "http://127.0.0.1:7898/",
+            httpsProxy: "http://127.0.0.1:7897/",
+        });
+    });
+    it("ignores disabled and malformed settings", () => {
+        expect(parseMacSystemProxy(`
+        HTTPEnable : 0
+        HTTPProxy : 127.0.0.1
+        HTTPPort : 7898
+        HTTPSEnable : 1
+        HTTPSProxy : 127.0.0.1
+        HTTPSPort : not-a-port
+      `)).toEqual({ httpProxy: null, httpsProxy: null });
+        expect(parseMacSystemProxy("HTTPSEnable : 1\nHTTPSProxy : 127.0.0.1\nHTTPSPort : 70000")).toEqual({
+            httpProxy: null,
+            httpsProxy: null,
+        });
+        expect(parseMacSystemProxy("HTTPSEnable : 1\nHTTPSProxy : proxy.test/path\nHTTPSPort : 7897")).toEqual({
+            httpProxy: null,
+            httpsProxy: null,
+        });
+    });
+});
+function macProxyOutput({ httpsEnabled = true } = {}) {
+    return `
+<dictionary> {
+  HTTPEnable : 1
+  HTTPPort : 7898
+  HTTPProxy : 127.0.0.1
+  HTTPSEnable : ${httpsEnabled ? "1" : "0"}
+  HTTPSPort : 7897
+  HTTPSProxy : 127.0.0.1
+}`;
+}

package/dist/tunnel/public-readiness.js

@@ -0,0 +1,82 @@
+import { fetch as undiciFetch, ProxyAgent } from "undici";
+import { resolveProxyForUrl } from "./proxy-settings.js";
+export async function waitForPublicReadiness(publicUrl, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 30_000;
+    const intervalMs = options.intervalMs ?? 750;
+    const endpoint = new URL("/api/web-auth/status", `${publicUrl.replace(/\/$/, "")}/`);
+    let proxyFetch = null;
+    let fetchImpl = options.fetchImpl;
+    if (!fetchImpl) {
+        const proxyResolver = options.proxyResolver ?? resolveProxyForUrl;
+        const proxyUrl = await proxyResolver(endpoint).catch(() => null);
+        if (proxyUrl)
+            proxyFetch = (options.proxyFetchFactory ?? createProxyFetch)(proxyUrl);
+        fetchImpl = proxyFetch?.fetch ?? fetch;
+    }
+    try {
+        const deadline = Date.now() + timeoutMs;
+        let lastFailure = "no response";
+        while (Date.now() <= deadline) {
+            if (options.signal?.aborted)
+                throw new Error("public tunnel readiness aborted");
+            try {
+                const response = await fetchImpl(endpoint, {
+                    cache: "no-store",
+                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.4" },
+                    signal: options.signal,
+                });
+                if (response.ok) {
+                    let body;
+                    try {
+                        body = (await response.json());
+                    }
+                    catch {
+                        throw new FatalReadinessError("HTTP 200 with invalid auth status JSON");
+                    }
+                    if (typeof body.authenticated === "boolean" && typeof body.needsSetup === "boolean")
+                        return;
+                    throw new FatalReadinessError("HTTP 200 with invalid auth status JSON");
+                }
+                else {
+                    lastFailure = `HTTP ${response.status}`;
+                    if (![404, 502, 503, 530].includes(response.status))
+                        throw new FatalReadinessError(lastFailure);
+                }
+            }
+            catch (error) {
+                if (options.signal?.aborted)
+                    throw new Error("public tunnel readiness aborted");
+                if (error instanceof FatalReadinessError)
+                    throw new Error(`public tunnel not ready: ${error.message}`);
+                lastFailure = error instanceof Error ? error.message : String(error);
+            }
+            if (Date.now() + intervalMs > deadline)
+                break;
+            await delay(intervalMs, options.signal);
+        }
+        throw new Error(`public tunnel not ready: ${lastFailure}`);
+    }
+    finally {
+        await proxyFetch?.close().catch(() => { });
+    }
+}
+class FatalReadinessError extends Error {
+}
+function createProxyFetch(proxyUrl) {
+    const dispatcher = new ProxyAgent(proxyUrl);
+    return {
+        fetch: async (input, init) => (await undiciFetch(input, { ...init, dispatcher })),
+        close: async () => {
+            await dispatcher.close();
+        },
+    };
+}
+function delay(milliseconds, signal) {
+    return new Promise((resolvePromise, reject) => {
+        const timer = setTimeout(resolvePromise, milliseconds);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timer);
+            reject(new Error("public tunnel readiness aborted"));
+        }, { once: true });
+    });
+}