clivly 0.10.5 → 0.10.6

package/index.cjs

@@ -480,23 +480,38 @@ function cloudflaredMissingMessage() {
 * Warning someone away from a tunnel that was fine is worse than staying quiet,
 * for the same reason the port probe defaults to assuming the port is alive.
 */
-/** How long to wait before giving up and returning `unknown`. */
+/** How long any single probe attempt may take. */
 const IDENTITY_PROBE_TIMEOUT_MS = 8e3;
 /**
-* Probe the published tunnel URL and report who is on the other end.
+* How long to keep retrying before giving up.
 *
-* `fetchImpl` is injectable so tests do not need a network or a live tunnel.
+* The probe fires the moment `cloudflared` publishes a URL, which on a
+* Vite/Nuxt app is *before* the dev server has finished building its route
+* table. The first attempt therefore reaches a server that is up but does not
+* yet serve the tick route — a cold start, not a wrong port. The condition
+* being detected (a tunnel aimed at the wrong process) does not resolve
+* itself, so waiting costs nothing and a premature verdict costs a lot.
 */
-async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
+const IDENTITY_RETRY_BUDGET_MS = 2e4;
+const IDENTITY_RETRY_DELAY_MS = 2e3;
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** One attempt. Separated so the retry loop stays readable. */
+async function attempt(triggerUrl, fetchImpl) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), IDENTITY_PROBE_TIMEOUT_MS);
 	try {
-		return (await fetchImpl(triggerUrl, {
+		const response = await fetchImpl(triggerUrl, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: "{}",
 			signal: controller.signal
-		})).status === 401 ? "clivly" : "mismatch";
+		});
+		if (response.status === 401) return "clivly";
+		if (response.status === 403) return "host-rejected";
+		if (response.status === 404 || response.status >= 500) return "unknown";
+		return "mismatch";
 	} catch {
 		return "unknown";
 	} finally {
@@ -504,6 +519,40 @@ async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
 	}
 }
 /**
+* Probe the published tunnel URL and report who is on the other end.
+*
+* Retries while the answer is inconclusive, because the first attempt lands
+* during the dev server's boot. Only a confident contradiction is reported.
+*
+* `fetchImpl` and `now` are injectable so tests need no network or clock.
+*/
+async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch, now = Date.now) {
+	const deadline = now() + IDENTITY_RETRY_BUDGET_MS;
+	let last = "unknown";
+	do {
+		last = await attempt(triggerUrl, fetchImpl);
+		if (last !== "unknown") return last;
+		if (now() >= deadline) break;
+		await sleep(IDENTITY_RETRY_DELAY_MS);
+	} while (now() < deadline);
+	return last;
+}
+/**
+* What to tell someone whose dev server refused the tunnel's Host header.
+*
+* `clivly dev` already prints the allowedHosts hint for Vite frameworks before
+* the tunnel opens; this fires when the tunnel proves it was not applied.
+*/
+function hostRejectedMessage() {
+	return [
+		"Warning: your dev server refused the tunnel's Host header (403).",
+		"  Vite rejects hostnames it does not recognise, so Clivly's request never",
+		"  reaches your tick route. Add the tunnel domain to your Vite config:",
+		"    server: { allowedHosts: ['.trycloudflare.com'] }",
+		"  (in nuxt.config.ts, nest it under `vite:`), then restart the dev server."
+	].join("\n");
+}
+/**
 * What to tell someone whose tunnel reaches the wrong process.
 *
 * Names the likely cause rather than only the symptom: the overwhelmingly
@@ -526,6 +575,12 @@ const UNREACHABLE_RESULT = {
 	ok: false,
 	kind: "unreachable"
 };
+/** The line to print for a probe verdict, or null when there is nothing to say. */
+function tunnelWarning(identity, port) {
+	if (identity === "mismatch") return tunnelMismatchMessage(port);
+	if (identity === "host-rejected") return hostRejectedMessage();
+	return null;
+}
 function flagValue$1(argv, flag) {
 	const i = argv.indexOf(flag);
 	return i >= 0 ? argv[i + 1] : void 0;
@@ -570,9 +625,10 @@ async function runDev(options) {
 			if (!await deps.isPortListening(port).catch(() => true)) deps.out(deadPortMessage(port, framework));
 		}
 		const identity = deps.probeTunnel && !flagValue$1(options.argv, "--url") ? await deps.probeTunnel(triggerUrl).catch(() => "unknown") : "unknown";
-		if (identity === "mismatch") deps.out(tunnelMismatchMessage(port));
+		const warning = tunnelWarning(identity, port);
+		if (warning) deps.out(warning);
 		const result = await deps.register(triggerUrl).catch(() => UNREACHABLE_RESULT);
-		if (result.ok) deps.out(identity === "mismatch" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
+		if (result.ok) deps.out(identity === "mismatch" || identity === "host-rejected" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
 		else deps.out(overrideFailureMessage(result.kind, result.status));
 	});
 	const stopWatching = deps.watchConfig?.(options.cwd, () => {

package/index.mjs

@@ -479,23 +479,38 @@ function cloudflaredMissingMessage() {
 * Warning someone away from a tunnel that was fine is worse than staying quiet,
 * for the same reason the port probe defaults to assuming the port is alive.
 */
-/** How long to wait before giving up and returning `unknown`. */
+/** How long any single probe attempt may take. */
 const IDENTITY_PROBE_TIMEOUT_MS = 8e3;
 /**
-* Probe the published tunnel URL and report who is on the other end.
+* How long to keep retrying before giving up.
 *
-* `fetchImpl` is injectable so tests do not need a network or a live tunnel.
+* The probe fires the moment `cloudflared` publishes a URL, which on a
+* Vite/Nuxt app is *before* the dev server has finished building its route
+* table. The first attempt therefore reaches a server that is up but does not
+* yet serve the tick route — a cold start, not a wrong port. The condition
+* being detected (a tunnel aimed at the wrong process) does not resolve
+* itself, so waiting costs nothing and a premature verdict costs a lot.
 */
-async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
+const IDENTITY_RETRY_BUDGET_MS = 2e4;
+const IDENTITY_RETRY_DELAY_MS = 2e3;
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** One attempt. Separated so the retry loop stays readable. */
+async function attempt(triggerUrl, fetchImpl) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), IDENTITY_PROBE_TIMEOUT_MS);
 	try {
-		return (await fetchImpl(triggerUrl, {
+		const response = await fetchImpl(triggerUrl, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: "{}",
 			signal: controller.signal
-		})).status === 401 ? "clivly" : "mismatch";
+		});
+		if (response.status === 401) return "clivly";
+		if (response.status === 403) return "host-rejected";
+		if (response.status === 404 || response.status >= 500) return "unknown";
+		return "mismatch";
 	} catch {
 		return "unknown";
 	} finally {
@@ -503,6 +518,40 @@ async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
 	}
 }
 /**
+* Probe the published tunnel URL and report who is on the other end.
+*
+* Retries while the answer is inconclusive, because the first attempt lands
+* during the dev server's boot. Only a confident contradiction is reported.
+*
+* `fetchImpl` and `now` are injectable so tests need no network or clock.
+*/
+async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch, now = Date.now) {
+	const deadline = now() + IDENTITY_RETRY_BUDGET_MS;
+	let last = "unknown";
+	do {
+		last = await attempt(triggerUrl, fetchImpl);
+		if (last !== "unknown") return last;
+		if (now() >= deadline) break;
+		await sleep(IDENTITY_RETRY_DELAY_MS);
+	} while (now() < deadline);
+	return last;
+}
+/**
+* What to tell someone whose dev server refused the tunnel's Host header.
+*
+* `clivly dev` already prints the allowedHosts hint for Vite frameworks before
+* the tunnel opens; this fires when the tunnel proves it was not applied.
+*/
+function hostRejectedMessage() {
+	return [
+		"Warning: your dev server refused the tunnel's Host header (403).",
+		"  Vite rejects hostnames it does not recognise, so Clivly's request never",
+		"  reaches your tick route. Add the tunnel domain to your Vite config:",
+		"    server: { allowedHosts: ['.trycloudflare.com'] }",
+		"  (in nuxt.config.ts, nest it under `vite:`), then restart the dev server."
+	].join("\n");
+}
+/**
 * What to tell someone whose tunnel reaches the wrong process.
 *
 * Names the likely cause rather than only the symptom: the overwhelmingly
@@ -525,6 +574,12 @@ const UNREACHABLE_RESULT = {
 	ok: false,
 	kind: "unreachable"
 };
+/** The line to print for a probe verdict, or null when there is nothing to say. */
+function tunnelWarning(identity, port) {
+	if (identity === "mismatch") return tunnelMismatchMessage(port);
+	if (identity === "host-rejected") return hostRejectedMessage();
+	return null;
+}
 function flagValue$1(argv, flag) {
 	const i = argv.indexOf(flag);
 	return i >= 0 ? argv[i + 1] : void 0;
@@ -569,9 +624,10 @@ async function runDev(options) {
 			if (!await deps.isPortListening(port).catch(() => true)) deps.out(deadPortMessage(port, framework));
 		}
 		const identity = deps.probeTunnel && !flagValue$1(options.argv, "--url") ? await deps.probeTunnel(triggerUrl).catch(() => "unknown") : "unknown";
-		if (identity === "mismatch") deps.out(tunnelMismatchMessage(port));
+		const warning = tunnelWarning(identity, port);
+		if (warning) deps.out(warning);
 		const result = await deps.register(triggerUrl).catch(() => UNREACHABLE_RESULT);
-		if (result.ok) deps.out(identity === "mismatch" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
+		if (result.ok) deps.out(identity === "mismatch" || identity === "host-rejected" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
 		else deps.out(overrideFailureMessage(result.kind, result.status));
 	});
 	const stopWatching = deps.watchConfig?.(options.cwd, () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clivly",
-  "version": "0.10.5",
+  "version": "0.10.6",
   "private": false,
   "type": "module",
   "description": "Clivly CLI — scaffold a CRM into your app (clivly init).",