agentroam 0.2.0-preview.3 → 0.2.0-preview.5

package/README.md

@@ -7,7 +7,7 @@ Zero-install mobile remote terminal and file console. **No desktop app, no VPN**
 - **Node.js 22** (required)
 - macOS arm64
 
-> Preview status: `0.2.0-preview.3` is intentionally limited to macOS arm64.
+> Preview status: `0.2.0-preview.5` is intentionally limited to macOS arm64.
 > macOS x64 and Windows x64 remain future formal-release targets.
 
 ## Quick start
@@ -19,7 +19,7 @@ npx agentroam@preview
 Or install from tarball:
 
 ```bash
-npm install ./agentroam-cloudflared-darwin-arm64-0.2.0-preview.3.tgz ./agentroam-0.2.0-preview.3.tgz
+npm install ./agentroam-cloudflared-darwin-arm64-0.2.0-preview.5.tgz ./agentroam-0.2.0-preview.5.tgz
 npx agentroam
 ```
 

package/dist/cli.js

@@ -9,7 +9,7 @@ import { detectPlatform } from "./platform.js";
 import { renderQr } from "./qr.js";
 import { RuntimeManager } from "./runtime-manager.js";
 import { selectRelay } from "./tunnel/relay-orchestrator.js";
-const VERSION = "0.2.0-preview.3";
+const VERSION = "0.2.0-preview.5";
 export async function main(argv) {
     const options = parseArgs(argv);
     const target = detectPlatform();

package/dist/cloudflared/bundled-asset.test.js

@@ -10,7 +10,7 @@ describe("resolveBundledCloudflared", () => {
         const archivePath = resolve(root, "cloudflared.tgz");
         await writeFile(archivePath, "archive");
         await writeFile(manifestPath, JSON.stringify({
-            packageVersion: "0.2.0-preview.3",
+            packageVersion: "0.2.0-preview.5",
             upstreamVersion: "2026.8.2",
             target: "darwin-arm64",
             fileName: "cloudflared",

package/dist/cloudflared/manifest.js

@@ -1,5 +1,5 @@
 export const CLOUDFLARED_VERSION = "2026.8.2";
-export const CLOUDFLARED_PACKAGE_VERSION = "0.2.0-preview.3";
+export const CLOUDFLARED_PACKAGE_VERSION = "0.2.0-preview.5";
 export const CLOUDFLARED_PACKAGES = {
     "darwin-arm64": "agentroam-cloudflared-darwin-arm64",
 };

package/dist/tunnel/cloudflare-provider.js

@@ -16,7 +16,7 @@ export class CloudflareTunnelProvider {
         if (signal.aborted)
             abort();
         try {
-            const publicUrl = await waitForUrl(child, log, 30_000);
+            const publicUrl = await waitForConnectedUrl(child, log, 30_000);
             const exited = new Promise((resolvePromise) => child.once("exit", (code, childSignal) => resolvePromise({ code, signal: childSignal })));
             return { publicUrl, exited, close: () => stopChildProcess(child) };
         }
@@ -26,9 +26,11 @@ export class CloudflareTunnelProvider {
         }
     }
 }
-function waitForUrl(child, log, timeoutMs) {
+export function waitForConnectedUrl(child, log, timeoutMs) {
     return new Promise((resolvePromise, reject) => {
-        let buffer = "";
+        const buffers = { stdout: "", stderr: "" };
+        let publicUrl = null;
+        let connected = false;
         let settled = false;
         const finish = (error, url) => {
             if (settled)
@@ -40,20 +42,25 @@ function waitForUrl(child, log, timeoutMs) {
             else
                 resolvePromise(url);
         };
-        const timer = setTimeout(() => finish(new Error("cloudflared tunnel URL timeout")), timeoutMs);
-        const read = (chunk) => {
+        const timer = setTimeout(() => finish(new Error("cloudflared tunnel connection timeout")), timeoutMs);
+        const read = (stream) => (chunk) => {
             const text = chunk.toString();
-            buffer = (buffer + text).slice(-8192);
+            const buffer = (buffers[stream] + text).slice(-8192);
+            buffers[stream] = buffer;
             for (const line of text.split(/\r?\n/))
                 if (line)
                     log(line.replace(/pair=[^\s&]+/g, "pair=[REDACTED]"));
             const match = buffer.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i);
             if (match)
-                finish(undefined, match[0]);
+                publicUrl = match[0];
+            if (/Registered tunnel connection/i.test(buffer))
+                connected = true;
+            if (publicUrl && connected)
+                finish(undefined, publicUrl);
         };
-        child.stdout?.on("data", read);
-        child.stderr?.on("data", read);
-        child.once("exit", (code) => finish(new Error(`cloudflared exited before URL (${code})`)));
+        child.stdout?.on("data", read("stdout"));
+        child.stderr?.on("data", read("stderr"));
+        child.once("exit", (code) => finish(new Error(`cloudflared exited before tunnel became ready (${code})`)));
         child.once("error", (error) => finish(error));
     });
 }

package/dist/tunnel/cloudflare-provider.test.js

@@ -0,0 +1,33 @@
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import { describe, expect, it, vi } from "vitest";
+import { waitForConnectedUrl } from "./cloudflare-provider.js";
+describe("waitForConnectedUrl", () => {
+    it("waits for both the public URL and a registered tunnel connection", async () => {
+        const { child, stderr } = fakeChild();
+        let resolved = false;
+        const ready = waitForConnectedUrl(child, vi.fn(), 100).then((url) => {
+            resolved = true;
+            return url;
+        });
+        stderr.write("https://ready.trycloudflare.com\n");
+        await new Promise((resolvePromise) => setImmediate(resolvePromise));
+        expect(resolved).toBe(false);
+        stderr.write("INF Registered tunnel ");
+        stderr.write("connection connIndex=0 protocol=quic\n");
+        await expect(ready).resolves.toBe("https://ready.trycloudflare.com");
+    });
+    it("supports registration output arriving before the URL", async () => {
+        const { child, stdout, stderr } = fakeChild();
+        const ready = waitForConnectedUrl(child, vi.fn(), 100);
+        stdout.write("INF Registered tunnel connection connIndex=0 protocol=http2\n");
+        stderr.write("Visit https://later.trycloudflare.com when ready\n");
+        await expect(ready).resolves.toBe("https://later.trycloudflare.com");
+    });
+});
+function fakeChild() {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    const child = Object.assign(new EventEmitter(), { stdout, stderr });
+    return { child, stdout, stderr };
+}

package/dist/tunnel/proxy-settings.js

@@ -0,0 +1,141 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function resolveProxyForUrl(target, options = {}) {
+    const env = options.env ?? process.env;
+    const noProxy = env.no_proxy?.trim() ? env.no_proxy : env.NO_PROXY;
+    if (matchesNoProxy(target, noProxy))
+        return null;
+    const environmentProxy = selectEnvironmentProxy(target.protocol, env);
+    if (environmentProxy !== null)
+        return normalizeProxyUrl(environmentProxy);
+    if ((options.platform ?? process.platform) !== "darwin")
+        return null;
+    try {
+        const output = await (options.readMacSystemProxy ?? readMacSystemProxy)();
+        const settings = parseMacSystemProxy(output);
+        if (target.protocol === "https:")
+            return settings.httpsProxy ?? settings.httpProxy;
+        if (target.protocol === "http:")
+            return settings.httpProxy;
+    }
+    catch {
+        // Proxy discovery is best-effort; direct readiness retains the previous behavior.
+    }
+    return null;
+}
+export function parseMacSystemProxy(output) {
+    const values = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^\s*([A-Za-z][A-Za-z0-9]*)\s*:\s*(.*?)\s*$/.exec(line);
+        if (match)
+            values.set(match[1], match[2]);
+    }
+    return {
+        httpProxy: buildMacProxy(values, "HTTP"),
+        httpsProxy: buildMacProxy(values, "HTTPS"),
+    };
+}
+async function readMacSystemProxy() {
+    const { stdout } = await execFileAsync("/usr/sbin/scutil", ["--proxy"], {
+        encoding: "utf8",
+        timeout: 2_000,
+    });
+    return stdout;
+}
+function selectEnvironmentProxy(protocol, env) {
+    const candidates = protocol === "https:"
+        ? [env.https_proxy, env.HTTPS_PROXY, env.http_proxy, env.HTTP_PROXY, env.all_proxy, env.ALL_PROXY]
+        : protocol === "http:"
+            ? [env.http_proxy, env.HTTP_PROXY, env.all_proxy, env.ALL_PROXY]
+            : [env.all_proxy, env.ALL_PROXY];
+    for (const candidate of candidates) {
+        if (candidate !== undefined && candidate.trim() !== "")
+            return candidate;
+    }
+    return null;
+}
+function normalizeProxyUrl(value) {
+    const candidate = value.trim();
+    try {
+        const proxy = new URL(candidate.includes("://") ? candidate : `http://${candidate}`);
+        if (!["http:", "https:"].includes(proxy.protocol) || proxy.hostname === "")
+            return null;
+        return proxy.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function buildMacProxy(values, prefix) {
+    if (values.get(`${prefix}Enable`) !== "1")
+        return null;
+    const host = values.get(`${prefix}Proxy`)?.trim();
+    const portText = values.get(`${prefix}Port`)?.trim();
+    const port = portText === undefined ? Number.NaN : Number(portText);
+    if (!host || /[\s\/?#@]/.test(host) || !Number.isInteger(port) || port < 1 || port > 65_535)
+        return null;
+    const formattedHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    return normalizeProxyUrl(`http://${formattedHost}:${port}`);
+}
+function matchesNoProxy(target, value) {
+    if (!value)
+        return false;
+    const hostname = normalizeHostname(target.hostname);
+    const targetPort = target.port || defaultPort(target.protocol);
+    for (const entry of value.split(",")) {
+        const rule = parseNoProxyRule(entry);
+        if (!rule)
+            continue;
+        if (rule.host === "*")
+            return true;
+        if (rule.port !== null && rule.port !== targetPort)
+            continue;
+        if (hostname === rule.host || hostname.endsWith(`.${rule.host}`))
+            return true;
+    }
+    return false;
+}
+function parseNoProxyRule(entry) {
+    let value = entry.trim().toLowerCase();
+    if (!value)
+        return null;
+    if (value === "*")
+        return { host: "*", port: null };
+    let host = value;
+    let port = null;
+    if (value.startsWith("[")) {
+        const closingBracket = value.indexOf("]");
+        if (closingBracket < 0)
+            return null;
+        host = value.slice(1, closingBracket);
+        const remainder = value.slice(closingBracket + 1);
+        if (remainder) {
+            if (!/^:\d+$/.test(remainder))
+                return null;
+            port = remainder.slice(1);
+        }
+    }
+    else {
+        const colon = value.lastIndexOf(":");
+        if (colon >= 0 && value.indexOf(":") === colon) {
+            const possiblePort = value.slice(colon + 1);
+            if (/^\d+$/.test(possiblePort)) {
+                host = value.slice(0, colon);
+                port = possiblePort;
+            }
+        }
+    }
+    host = normalizeHostname(host.replace(/^\*?\./, ""));
+    return host ? { host, port } : null;
+}
+function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function defaultPort(protocol) {
+    if (protocol === "https:")
+        return "443";
+    if (protocol === "http:")
+        return "80";
+    return "";
+}

package/dist/tunnel/proxy-settings.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from "vitest";
+import { parseMacSystemProxy, resolveProxyForUrl } from "./proxy-settings.js";
+const target = new URL("https://api.example.test/status");
+describe("resolveProxyForUrl", () => {
+    it("prefers the lowercase HTTPS proxy and normalizes an omitted scheme", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {
+                https_proxy: "127.0.0.1:7897",
+                HTTPS_PROXY: "http://uppercase.test:8080",
+                HTTP_PROXY: "http://http.test:8080",
+            },
+            platform: "linux",
+        })).resolves.toBe("http://127.0.0.1:7897/");
+    });
+    it("uses HTTP_PROXY as the HTTPS fallback and ALL_PROXY for HTTP", async () => {
+        await expect(resolveProxyForUrl(target, { env: { HTTP_PROXY: "http://http.test:8080" }, platform: "linux" })).resolves.toBe("http://http.test:8080/");
+        await expect(resolveProxyForUrl(new URL("http://example.test"), {
+            env: { ALL_PROXY: "https://all.test:8443" },
+            platform: "linux",
+        })).resolves.toBe("https://all.test:8443/");
+    });
+    it.each([
+        ["*", "https://api.example.test/status"],
+        ["api.example.test", "https://api.example.test/status"],
+        [".example.test", "https://api.example.test/status"],
+        ["example.test", "https://api.example.test/status"],
+        ["api.example.test:443", "https://api.example.test/status"],
+        ["api.example.test:8443", "https://api.example.test:8443/status"],
+    ])("bypasses the proxy for NO_PROXY=%s", async (noProxy, url) => {
+        await expect(resolveProxyForUrl(new URL(url), {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", NO_PROXY: noProxy },
+            platform: "darwin",
+            readMacSystemProxy: vi.fn(async () => macProxyOutput()),
+        })).resolves.toBeNull();
+    });
+    it("does not bypass a suffix lookalike or a rule with a different port", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", no_proxy: "notexample.test,api.example.test:8443" },
+            platform: "linux",
+        })).resolves.toBe("http://proxy.test:8080/");
+    });
+    it("falls back to uppercase NO_PROXY when the lowercase value is empty", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: { HTTPS_PROXY: "http://proxy.test:8080", no_proxy: "", NO_PROXY: "example.test" },
+            platform: "linux",
+        })).resolves.toBeNull();
+    });
+    it("falls back to the enabled macOS HTTPS proxy", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => macProxyOutput(),
+        })).resolves.toBe("http://127.0.0.1:7897/");
+    });
+    it("uses the macOS HTTP proxy when HTTPS proxying is disabled", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => macProxyOutput({ httpsEnabled: false }),
+        })).resolves.toBe("http://127.0.0.1:7898/");
+    });
+    it("returns direct mode for command failures and non-macOS platforms", async () => {
+        await expect(resolveProxyForUrl(target, {
+            env: {},
+            platform: "darwin",
+            readMacSystemProxy: async () => {
+                throw new Error("scutil failed");
+            },
+        })).resolves.toBeNull();
+        const reader = vi.fn(async () => macProxyOutput());
+        await expect(resolveProxyForUrl(target, { env: {}, platform: "linux", readMacSystemProxy: reader })).resolves.toBeNull();
+        expect(reader).not.toHaveBeenCalled();
+    });
+});
+describe("parseMacSystemProxy", () => {
+    it("parses enabled HTTP and HTTPS settings", () => {
+        expect(parseMacSystemProxy(macProxyOutput())).toEqual({
+            httpProxy: "http://127.0.0.1:7898/",
+            httpsProxy: "http://127.0.0.1:7897/",
+        });
+    });
+    it("ignores disabled and malformed settings", () => {
+        expect(parseMacSystemProxy(`
+        HTTPEnable : 0
+        HTTPProxy : 127.0.0.1
+        HTTPPort : 7898
+        HTTPSEnable : 1
+        HTTPSProxy : 127.0.0.1
+        HTTPSPort : not-a-port
+      `)).toEqual({ httpProxy: null, httpsProxy: null });
+        expect(parseMacSystemProxy("HTTPSEnable : 1\nHTTPSProxy : 127.0.0.1\nHTTPSPort : 70000")).toEqual({
+            httpProxy: null,
+            httpsProxy: null,
+        });
+        expect(parseMacSystemProxy("HTTPSEnable : 1\nHTTPSProxy : proxy.test/path\nHTTPSPort : 7897")).toEqual({
+            httpProxy: null,
+            httpsProxy: null,
+        });
+    });
+});
+function macProxyOutput({ httpsEnabled = true } = {}) {
+    return `
+<dictionary> {
+  HTTPEnable : 1
+  HTTPPort : 7898
+  HTTPProxy : 127.0.0.1
+  HTTPSEnable : ${httpsEnabled ? "1" : "0"}
+  HTTPSPort : 7897
+  HTTPSProxy : 127.0.0.1
+}`;
+}

package/dist/tunnel/public-readiness.js

@@ -1,52 +1,76 @@
+import { fetch as undiciFetch, ProxyAgent } from "undici";
+import { resolveProxyForUrl } from "./proxy-settings.js";
 export async function waitForPublicReadiness(publicUrl, options = {}) {
     const timeoutMs = options.timeoutMs ?? 30_000;
     const intervalMs = options.intervalMs ?? 750;
-    const fetchImpl = options.fetchImpl ?? fetch;
     const endpoint = new URL("/api/web-auth/status", `${publicUrl.replace(/\/$/, "")}/`);
-    const deadline = Date.now() + timeoutMs;
-    let lastFailure = "no response";
-    while (Date.now() <= deadline) {
-        if (options.signal?.aborted)
-            throw new Error("public tunnel readiness aborted");
-        try {
-            const response = await fetchImpl(endpoint, {
-                cache: "no-store",
-                headers: { "user-agent": "agentroam-readiness/0.2.0-preview.3" },
-                signal: options.signal,
-            });
-            if (response.ok) {
-                let body;
-                try {
-                    body = (await response.json());
-                }
-                catch {
+    let proxyFetch = null;
+    let fetchImpl = options.fetchImpl;
+    if (!fetchImpl) {
+        const proxyResolver = options.proxyResolver ?? resolveProxyForUrl;
+        const proxyUrl = await proxyResolver(endpoint).catch(() => null);
+        if (proxyUrl)
+            proxyFetch = (options.proxyFetchFactory ?? createProxyFetch)(proxyUrl);
+        fetchImpl = proxyFetch?.fetch ?? fetch;
+    }
+    try {
+        const deadline = Date.now() + timeoutMs;
+        let lastFailure = "no response";
+        while (Date.now() <= deadline) {
+            if (options.signal?.aborted)
+                throw new Error("public tunnel readiness aborted");
+            try {
+                const response = await fetchImpl(endpoint, {
+                    cache: "no-store",
+                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.5" },
+                    signal: options.signal,
+                });
+                if (response.ok) {
+                    let body;
+                    try {
+                        body = (await response.json());
+                    }
+                    catch {
+                        throw new FatalReadinessError("HTTP 200 with invalid auth status JSON");
+                    }
+                    if (typeof body.authenticated === "boolean" && typeof body.needsSetup === "boolean")
+                        return;
                     throw new FatalReadinessError("HTTP 200 with invalid auth status JSON");
                 }
-                if (typeof body.authenticated === "boolean" && typeof body.needsSetup === "boolean")
-                    return;
-                throw new FatalReadinessError("HTTP 200 with invalid auth status JSON");
+                else {
+                    lastFailure = `HTTP ${response.status}`;
+                    if (![404, 502, 503, 530].includes(response.status))
+                        throw new FatalReadinessError(lastFailure);
+                }
             }
-            else {
-                lastFailure = `HTTP ${response.status}`;
-                if (![404, 502, 503, 530].includes(response.status))
-                    throw new FatalReadinessError(lastFailure);
+            catch (error) {
+                if (options.signal?.aborted)
+                    throw new Error("public tunnel readiness aborted");
+                if (error instanceof FatalReadinessError)
+                    throw new Error(`public tunnel not ready: ${error.message}`);
+                lastFailure = error instanceof Error ? error.message : String(error);
             }
+            if (Date.now() + intervalMs > deadline)
+                break;
+            await delay(intervalMs, options.signal);
         }
-        catch (error) {
-            if (options.signal?.aborted)
-                throw new Error("public tunnel readiness aborted");
-            if (error instanceof FatalReadinessError)
-                throw new Error(`public tunnel not ready: ${error.message}`);
-            lastFailure = error instanceof Error ? error.message : String(error);
-        }
-        if (Date.now() + intervalMs > deadline)
-            break;
-        await delay(intervalMs, options.signal);
+        throw new Error(`public tunnel not ready: ${lastFailure}`);
+    }
+    finally {
+        await proxyFetch?.close().catch(() => { });
     }
-    throw new Error(`public tunnel not ready: ${lastFailure}`);
 }
 class FatalReadinessError extends Error {
 }
+function createProxyFetch(proxyUrl) {
+    const dispatcher = new ProxyAgent(proxyUrl);
+    return {
+        fetch: async (input, init) => (await undiciFetch(input, { ...init, dispatcher })),
+        close: async () => {
+            await dispatcher.close();
+        },
+    };
+}
 function delay(milliseconds, signal) {
     return new Promise((resolvePromise, reject) => {
         const timer = setTimeout(resolvePromise, milliseconds);

package/dist/tunnel/public-readiness.test.js

@@ -21,4 +21,84 @@ describe("waitForPublicReadiness", () => {
         const fetchImpl = vi.fn().mockResolvedValue(new Response("bad gateway", { status: 502 }));
         await expect(waitForPublicReadiness("https://example.test", { fetchImpl, intervalMs: 1, timeoutMs: 5 })).rejects.toThrow("HTTP 502");
     });
+    it("reuses one proxy handle across retries and closes it after success", async () => {
+        const close = vi.fn(async () => { });
+        const proxiedFetch = vi
+            .fn()
+            .mockResolvedValueOnce(new Response("unavailable", { status: 530 }))
+            .mockResolvedValueOnce(Response.json({ authenticated: false, needsSetup: true }, { status: 200 }));
+        const proxyFetchFactory = vi.fn(() => ({ fetch: proxiedFetch, close }));
+        await waitForPublicReadiness("https://example.test", {
+            intervalMs: 1,
+            timeoutMs: 100,
+            proxyResolver: async () => "http://127.0.0.1:7897/",
+            proxyFetchFactory,
+        });
+        expect(proxyFetchFactory).toHaveBeenCalledOnce();
+        expect(proxiedFetch).toHaveBeenCalledTimes(2);
+        expect(close).toHaveBeenCalledOnce();
+    });
+    it.each([
+        {
+            name: "a fatal response",
+            fetchImpl: vi.fn().mockResolvedValue(new Response("forbidden", { status: 403 })),
+            timeoutMs: 100,
+            expected: "HTTP 403",
+        },
+        {
+            name: "a timeout",
+            fetchImpl: vi.fn().mockResolvedValue(new Response("unavailable", { status: 530 })),
+            timeoutMs: 2,
+            expected: "HTTP 530",
+        },
+    ])("closes the proxy handle after $name", async ({ fetchImpl, timeoutMs, expected }) => {
+        const close = vi.fn(async () => { });
+        await expect(waitForPublicReadiness("https://example.test", {
+            intervalMs: 1,
+            timeoutMs,
+            proxyResolver: async () => "http://127.0.0.1:7897/",
+            proxyFetchFactory: () => ({ fetch: fetchImpl, close }),
+        })).rejects.toThrow(expected);
+        expect(close).toHaveBeenCalledOnce();
+    });
+    it("closes the proxy handle when readiness is aborted", async () => {
+        const controller = new AbortController();
+        const close = vi.fn(async () => { });
+        const proxiedFetch = vi.fn().mockImplementation(async () => {
+            controller.abort();
+            throw new Error("request aborted");
+        });
+        await expect(waitForPublicReadiness("https://example.test", {
+            signal: controller.signal,
+            proxyResolver: async () => "http://127.0.0.1:7897/",
+            proxyFetchFactory: () => ({ fetch: proxiedFetch, close }),
+        })).rejects.toThrow("public tunnel readiness aborted");
+        expect(close).toHaveBeenCalledOnce();
+    });
+    it("does not create a proxy handle in direct mode", async () => {
+        const proxyFetchFactory = vi.fn();
+        const directFetch = vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(Response.json({ authenticated: false, needsSetup: true }));
+        try {
+            await waitForPublicReadiness("https://example.test", {
+                proxyResolver: async () => null,
+                proxyFetchFactory,
+            });
+        }
+        finally {
+            directFetch.mockRestore();
+        }
+        expect(proxyFetchFactory).not.toHaveBeenCalled();
+    });
+    it("skips proxy discovery when a fetch implementation is injected", async () => {
+        const proxyResolver = vi.fn(async () => "http://127.0.0.1:7897/");
+        const proxyFetchFactory = vi.fn();
+        const fetchImpl = vi.fn().mockResolvedValue(Response.json({ authenticated: false, needsSetup: true }));
+        await waitForPublicReadiness("https://example.test", {
+            fetchImpl,
+            proxyResolver,
+            proxyFetchFactory,
+        });
+        expect(proxyResolver).not.toHaveBeenCalled();
+        expect(proxyFetchFactory).not.toHaveBeenCalled();
+    });
 });

package/package.json

@@ -1,23 +1,37 @@
 {
   "name": "agentroam",
-  "version": "0.2.0-preview.3",
+  "version": "0.2.0-preview.5",
   "description": "Zero-install mobile remote terminal and file console",
   "type": "module",
-  "bin": { "agentroam": "./bin/agentroam.mjs" },
-  "engines": { "node": ">=22 <23" },
-  "os": ["darwin"],
-  "cpu": ["arm64"],
-  "files": ["bin", "dist", "runtime", "README.md"],
+  "bin": {
+    "agentroam": "./bin/agentroam.mjs"
+  },
+  "engines": {
+    "node": ">=22 <23"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "files": [
+    "bin",
+    "dist",
+    "runtime",
+    "README.md"
+  ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run --root ../.. packages/cli/src",
     "prepack": "node ../../scripts/stage-cli-runtime.mjs && npm run build"
   },
   "dependencies": {
-    "qrcode-terminal": "^0.12.0"
+    "qrcode-terminal": "^0.12.0",
+    "undici": "^6.25.0"
   },
   "optionalDependencies": {
-    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.3"
+    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -26,5 +40,9 @@
     "vitest": "^2.1.0"
   },
   "license": "MIT",
-  "publishConfig": { "access": "public", "provenance": true, "tag": "preview" }
+  "publishConfig": {
+    "access": "public",
+    "provenance": true,
+    "tag": "preview"
+  }
 }

package/runtime/.next/BUILD_ID

@@ -1 +1 @@
-OszWLAB2kMAnNfSwJzpyw
+mZZGSYMLIZnVm0gc5PXky