coderemote 0.1.2 → 0.2.0

package/dist/coderemote.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
 // bin/coderemote.js
-import { execFile as execFile3, spawn } from "node:child_process";
+import { execFile as execFile5, spawn as spawn3 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import fs6 from "node:fs";
-import os3 from "node:os";
+import fs7 from "node:fs";
+import os4 from "node:os";
 import path6 from "node:path";
-import { promisify as promisify2 } from "node:util";
+import { promisify as promisify3 } from "node:util";
 import qrcode from "qrcode-terminal";
 
 // ../../packages/agent-core/src/server.js
 import { createReadStream, createWriteStream } from "node:fs";
-import fs3 from "node:fs/promises";
-import http from "node:http";
-import os2 from "node:os";
+import fs4 from "node:fs/promises";
+import http2 from "node:http";
+import os3 from "node:os";
 import path3 from "node:path";
 import { pipeline } from "node:stream/promises";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
@@ -43,7 +43,18 @@ var Routes = Object.freeze({
   gitShow: "GET /api/git/show",
   gitPull: "POST /api/git/pull",
   gitPush: "POST /api/git/push",
-  tunnelToken: "POST /api/tunnel/token"
+  portsList: "GET /api/ports",
+  portsKill: "POST /api/ports/kill",
+  previewList: "GET /api/preview",
+  previewOpen: "POST /api/preview",
+  previewClose: "DELETE /api/preview",
+  previewShare: "POST /api/preview/share",
+  previewUnshare: "DELETE /api/preview/share",
+  previewRequests: "GET /api/preview/requests",
+  previewRequest: "GET /api/preview/request",
+  previewRequestsClear: "DELETE /api/preview/requests",
+  tunnelToken: "POST /api/tunnel/token",
+  tunnelStatus: "GET /api/tunnel"
 });
 var TUNNEL_HANDOFF_PATH = "/vsremote/handoff";
 var TUNNEL_AUTH_CALLBACK_HOST = "tunnel-auth";
@@ -352,26 +363,328 @@ var LANDING_HTML = `<!doctype html>
   <p id="missing" class="hidden">This link is missing its access token. Copy the full link printed by <code>coderemote up</code>.</p>
 </main>
 <script>
-  const token = new URLSearchParams(location.hash.slice(1)).get('token');
-  if (token) {
+  // Pasting the full link into a tab already showing this page (e.g. after the tunnel's sign-in
+  // dropped the fragment) only changes the hash and doesn't reload, so re-read it on hashchange.
+  function render() {
+    const token = new URLSearchParams(location.hash.slice(1)).get('token');
+    document.getElementById('ready').classList.toggle('hidden', !token);
+    document.getElementById('missing').classList.toggle('hidden', !!token);
+    if (!token) return;
     const link = '${PAIRING_SCHEME}://pair?url=' + encodeURIComponent(location.origin) + '&token=' + encodeURIComponent(token);
     document.getElementById('open').href = link;
+    document.getElementById('copy').textContent = 'Copy pairing link';
     document.getElementById('copy').onclick = async (e) => {
       try { await navigator.clipboard.writeText(link); e.target.textContent = 'Copied'; }
       catch { prompt('Pairing link', link); }
     };
-    document.getElementById('ready').classList.remove('hidden');
-  } else {
-    document.getElementById('missing').classList.remove('hidden');
   }
+  render();
+  addEventListener('hashchange', render);
 </script>
 </body>
 </html>
 `;
 
+// ../../packages/agent-core/src/ports.js
+import { execFile as execFile2 } from "node:child_process";
+import fs3 from "node:fs/promises";
+import os from "node:os";
+function run(cmd2, args) {
+  return new Promise((resolve, reject) => {
+    execFile2(cmd2, args, { maxBuffer: 8 * 1024 * 1024 }, (err, stdout) => {
+      if (err?.code === "ENOENT") reject(err);
+      else resolve(stdout || "");
+    });
+  });
+}
+function splitHostPort(name) {
+  const i = name.lastIndexOf(":");
+  const port2 = parseInt(name.slice(i + 1), 10);
+  if (i < 0 || !Number.isInteger(port2)) return null;
+  return { address: name.slice(0, i).replace(/^\[|\]$/g, ""), port: port2 };
+}
+async function listeningSockets() {
+  try {
+    const out2 = await run("lsof", ["-nP", "-a", "-u", String(os.userInfo().uid), "-iTCP", "-sTCP:LISTEN", "-F", "pcn"]);
+    const sockets2 = [];
+    let pid;
+    let name;
+    for (const line of out2.split("\n")) {
+      const field = line.slice(1);
+      if (line[0] === "p") pid = parseInt(field, 10);
+      else if (line[0] === "c") name = field;
+      else if (line[0] === "n") {
+        const hp = splitHostPort(field);
+        if (hp) sockets2.push({ pid, name, ...hp });
+      }
+    }
+    return sockets2;
+  } catch (e) {
+    if (e.code !== "ENOENT" || os.platform() !== "linux") throw e;
+  }
+  const out = await run("ss", ["-Hltnp"]);
+  const sockets = [];
+  for (const line of out.split("\n")) {
+    const cols = line.trim().split(/\s+/);
+    const hp = cols[3] && splitHostPort(cols[3]);
+    if (!hp) continue;
+    for (const m of line.matchAll(/\("([^"]*)",pid=(\d+)/g)) sockets.push({ pid: parseInt(m[2], 10), name: m[1], ...hp });
+  }
+  return sockets;
+}
+async function processTable() {
+  const out = await run("ps", ["-A", "-ww", "-o", "pid=,ppid=,command="]);
+  const table = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    const m = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
+    if (m) table.set(parseInt(m[1], 10), { ppid: parseInt(m[2], 10), command: m[3] });
+  }
+  return table;
+}
+async function workingDirs(pids) {
+  const dirs = /* @__PURE__ */ new Map();
+  if (!pids.length) return dirs;
+  if (os.platform() === "linux") {
+    await Promise.all(pids.map(async (pid2) => dirs.set(pid2, await fs3.readlink(`/proc/${pid2}/cwd`).catch(() => null))));
+    return dirs;
+  }
+  const out = await run("lsof", ["-a", "-p", pids.join(","), "-d", "cwd", "-F", "pn"]).catch(() => "");
+  let pid;
+  for (const line of out.split("\n")) {
+    if (line[0] === "p") pid = parseInt(line.slice(1), 10);
+    else if (line[0] === "n") dirs.set(pid, line.slice(1));
+  }
+  return dirs;
+}
+var AGENT_COMMAND = /(^|[\/\s])coderemote(\.js)?\s+up(\s|$)/;
+async function listPorts(shells = /* @__PURE__ */ new Map()) {
+  const [sockets, table] = await Promise.all([listeningSockets(), processTable()]);
+  const byKey = /* @__PURE__ */ new Map();
+  for (const s of sockets) {
+    const key = `${s.pid}:${s.port}`;
+    const entry2 = byKey.get(key);
+    if (entry2) {
+      if (!entry2.addresses.includes(s.address)) entry2.addresses.push(s.address);
+      continue;
+    }
+    byKey.set(key, {
+      port: s.port,
+      addresses: [s.address],
+      pid: s.pid,
+      name: s.name,
+      command: table.get(s.pid)?.command ?? s.name,
+      cwd: null,
+      session: sessionOf(s.pid, table, shells),
+      self: s.pid === process.pid,
+      agent: s.pid === process.pid || AGENT_COMMAND.test(table.get(s.pid)?.command ?? "")
+    });
+  }
+  const entries = [...byKey.values()];
+  const dirs = await workingDirs([...new Set(entries.map((e) => e.pid))]);
+  for (const e of entries) e.cwd = dirs.get(e.pid) ?? null;
+  return entries.sort((a, b) => a.port - b.port || a.pid - b.pid);
+}
+function sessionOf(pid, table, shells) {
+  for (let p = pid, depth = 0; p > 1 && depth < 64; p = table.get(p)?.ppid, depth++) {
+    if (shells.has(p)) return shells.get(p);
+  }
+  return null;
+}
+async function killListener(pid, { force = false, shells } = {}) {
+  if (!Number.isInteger(pid) || pid <= 1) throw new HttpError(400, "pid must be a process id");
+  if (pid === process.pid) throw new HttpError(403, "the agent cannot stop itself");
+  const ports = await listPorts(shells);
+  if (!ports.some((p) => p.pid === pid)) throw new HttpError(404, "no listening process with that pid");
+  try {
+    process.kill(pid, force ? "SIGKILL" : "SIGTERM");
+  } catch (e) {
+    if (e.code === "ESRCH") throw new HttpError(404, "no listening process with that pid");
+    throw e;
+  }
+}
+
+// ../../packages/agent-core/src/inspector.js
+import http from "node:http";
+import net from "node:net";
+import zlib from "node:zlib";
+var MAX_ENTRIES = 200;
+var MAX_BODY = 64 * 1024;
+var TEXTUAL = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql|[\w.+-]+\+(json|xml)))/i;
+var nextId = 1;
+var BodyTap = class {
+  chunks = [];
+  kept = 0;
+  size = 0;
+  push(chunk) {
+    this.size += chunk.length;
+    if (this.kept < MAX_BODY) {
+      const part = chunk.subarray(0, MAX_BODY - this.kept);
+      this.chunks.push(part);
+      this.kept += part.length;
+    }
+  }
+  /** { size, truncated, text? | base64? }, decoded when the whole body was kept. */
+  describe(headers) {
+    const body = { size: this.size, truncated: this.size > this.kept };
+    if (!this.size || body.truncated) return body;
+    let data = Buffer.concat(this.chunks);
+    const encoding = String(headers["content-encoding"] || "").toLowerCase();
+    try {
+      if (encoding === "gzip") data = zlib.gunzipSync(data);
+      else if (encoding === "br") data = zlib.brotliDecompressSync(data);
+      else if (encoding === "deflate") data = zlib.inflateSync(data);
+    } catch {
+      return body;
+    }
+    if (TEXTUAL.test(String(headers["content-type"] || ""))) body.text = data.toString("utf8");
+    else body.base64 = data.toString("base64");
+    return body;
+  }
+};
+var InspectingProxy = class {
+  /** @type {object[]} */
+  #entries = [];
+  /** @param {number} target  the dev server's port on this machine */
+  constructor(target) {
+    this.target = target;
+    this.server = http.createServer((req, res) => this.#forward(req, res));
+    this.server.on("upgrade", (req, socket, head) => this.#tunnelUpgrade(req, socket, head));
+  }
+  /** Listens on a free loopback port; resolves to it. */
+  async listen() {
+    await new Promise((resolve, reject) => {
+      this.server.once("error", reject);
+      this.server.listen(0, "127.0.0.1", resolve);
+    });
+    this.port = this.server.address().port;
+    return this.port;
+  }
+  close() {
+    this.server.closeAllConnections?.();
+    this.server.close();
+  }
+  /** Summaries, oldest first; `after` skips ids up to and including it. */
+  list(after = 0) {
+    return this.#entries.filter((e) => e.id > after).map(summary);
+  }
+  get(id) {
+    return this.#entries.find((e) => e.id === id);
+  }
+  clear() {
+    this.#entries = [];
+  }
+  #record(req) {
+    const entry2 = {
+      id: nextId++,
+      time: Date.now(),
+      method: req.method,
+      path: req.url,
+      status: null,
+      duration: null,
+      error: null,
+      request: { headers: req.headers, tap: new BodyTap() },
+      response: { headers: {}, tap: new BodyTap() }
+    };
+    this.#entries.push(entry2);
+    if (this.#entries.length > MAX_ENTRIES) this.#entries.shift();
+    return entry2;
+  }
+  /** The dev server sees itself addressed as localhost:<its port>, as without the proxy. */
+  #headers(req) {
+    return { ...req.headers, host: `localhost:${this.target}` };
+  }
+  #forward(req, res) {
+    const entry2 = this.#record(req);
+    const started = performance.now();
+    const finish = () => {
+      entry2.duration = Math.round(performance.now() - started);
+    };
+    const upstream = http.request({
+      agent: false,
+      host: "localhost",
+      port: this.target,
+      method: req.method,
+      path: req.url,
+      headers: this.#headers(req)
+    });
+    upstream.on("response", (up) => {
+      entry2.status = up.statusCode;
+      entry2.response.headers = up.headers;
+      res.writeHead(up.statusCode, up.statusMessage, up.rawHeaders);
+      up.on("data", (chunk) => {
+        entry2.response.tap.push(chunk);
+        res.write(chunk);
+      });
+      up.on("end", () => {
+        finish();
+        res.end();
+      });
+      up.on("error", () => res.destroy());
+    });
+    upstream.on("error", (e) => {
+      finish();
+      entry2.error = e.code === "ECONNREFUSED" ? `nothing is listening on port ${this.target}` : e.message;
+      if (res.headersSent) return res.destroy();
+      entry2.status = 502;
+      res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+      res.end(`coderemote preview: ${entry2.error}
+`);
+    });
+    req.on("data", (chunk) => entry2.request.tap.push(chunk));
+    req.pipe(upstream);
+    res.on("close", () => {
+      if (!res.writableFinished) upstream.destroy();
+    });
+  }
+  /** WebSockets (hot reload) pass through as raw bytes; only the handshake is recorded. */
+  #tunnelUpgrade(req, socket, head) {
+    const entry2 = this.#record(req);
+    const upstream = net.connect({ host: "localhost", port: this.target }, () => {
+      const headers = this.#headers(req);
+      const lines = [`${req.method} ${req.url} HTTP/1.1`];
+      for (const [k, v] of Object.entries(headers)) {
+        for (const value of Array.isArray(v) ? v : [v]) lines.push(`${k}: ${value}`);
+      }
+      upstream.write(`${lines.join("\r\n")}\r
+\r
+`);
+      if (head?.length) upstream.write(head);
+      entry2.status = 101;
+      upstream.pipe(socket);
+      socket.pipe(upstream);
+    });
+    upstream.on("error", (e) => {
+      entry2.error = e.message;
+      socket.destroy();
+    });
+    socket.on("error", () => upstream.destroy());
+  }
+};
+function summary(e) {
+  return {
+    id: e.id,
+    time: e.time,
+    method: e.method,
+    path: e.path,
+    status: e.status,
+    duration: e.duration,
+    error: e.error,
+    contentType: e.response.headers["content-type"] ?? null,
+    requestSize: e.request.tap.size,
+    responseSize: e.response.tap.size
+  };
+}
+function detail(e) {
+  return {
+    ...summary(e),
+    request: { headers: e.request.headers, body: e.request.tap.describe(e.request.headers) },
+    response: { headers: e.response.headers, body: e.response.tap.describe(e.response.headers) }
+  };
+}
+
 // ../../packages/agent-core/src/sessions.js
 import { randomUUID } from "node:crypto";
-import os from "node:os";
+import os2 from "node:os";
 import pty from "node-pty";
 var SCROLLBACK_LIMIT = 256 * 1024;
 var TerminalSession = class {
@@ -382,13 +695,13 @@ var TerminalSession = class {
     this.bufferedBytes = 0;
     this.clients = /* @__PURE__ */ new Set();
     this.exitCode = null;
-    const shell = process.env.SHELL || (os.platform() === "win32" ? "powershell.exe" : "/bin/sh");
+    const shell = process.env.SHELL || (os2.platform() === "win32" ? "powershell.exe" : "/bin/sh");
     this.shell = shell;
     this.pty = pty.spawn(shell, ["-l"], {
       name: "xterm-256color",
       cols,
       rows,
-      cwd: cwd || os.homedir(),
+      cwd: cwd || os2.homedir(),
       env: { ...process.env, TERM: "xterm-256color", COLORTERM: "truecolor" }
     });
     this.pty.onData((data) => this.#output(Buffer.from(data, "utf8")));
@@ -476,11 +789,11 @@ function kindOf(stat) {
   return "other";
 }
 async function describe(fullPath, name) {
-  const lst = await fs3.lstat(fullPath);
+  const lst = await fs4.lstat(fullPath);
   const entry2 = { name, type: kindOf(lst), size: lst.size, mtime: lst.mtimeMs };
   if (lst.isSymbolicLink()) {
     try {
-      entry2.target = kindOf(await fs3.stat(fullPath));
+      entry2.target = kindOf(await fs4.stat(fullPath));
     } catch {
       entry2.target = "broken";
     }
@@ -501,7 +814,7 @@ async function readJson(req) {
     throw new HttpError(400, "invalid json");
   }
 }
-function createAgentServer({ token, root: root2, tunnelToken = async () => null }) {
+function createAgentServer({ token, root: root2, tunnelToken = async () => null, preview = null, tunnelStatus: tunnelStatus2 = null }) {
   const handoff = new TunnelHandoff({ token, mint: tunnelToken });
   const sandbox = new Sandbox(root2);
   const sessions = new SessionManager();
@@ -510,10 +823,45 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
     const got = Buffer.from(req.headers.authorization || "");
     return got.length === expected.length && timingSafeEqual2(got, expected);
   }
+  function previewPort(value, ownPort) {
+    if (!preview) throw new HttpError(404, "previews need a tunnel");
+    const port2 = Number(value);
+    if (!Number.isInteger(port2) || port2 < 1 || port2 > 65535) throw new HttpError(400, "port must be 1-65535");
+    if (port2 === ownPort) throw new HttpError(400, "the agent's own port is already on its tunnel");
+    if ([...proxies.values()].some((p) => p.port === port2)) throw new HttpError(400, "that port is a preview proxy");
+    return port2;
+  }
+  const proxies = /* @__PURE__ */ new Map();
+  function previewed(port2) {
+    const proxy = proxies.get(port2);
+    if (!proxy || !preview.list().some((p) => p.port === proxy.port)) {
+      throw new HttpError(404, "that port is not being previewed");
+    }
+    return proxy;
+  }
+  function inspected(value) {
+    const proxy = proxies.get(previewPort(value, server.address()?.port));
+    if (!proxy) throw new HttpError(404, "that port has not been previewed");
+    return proxy;
+  }
+  async function previews() {
+    const issued = await preview.token();
+    const forwarded = new Map(preview.list().map((p) => [p.port, p]));
+    const ports = [];
+    for (const [port2, proxy] of proxies) {
+      const p = forwarded.get(proxy.port);
+      if (p) ports.push({ ...p, port: port2 });
+    }
+    ports.sort((a, b) => a.port - b.port);
+    return { ports, token: issued?.token ?? null, expiresAt: issued?.expiresAt ?? null };
+  }
+  function shellPids() {
+    return new Map(sessions.list().map((s) => [s.pid, s.id]));
+  }
   async function repoOf(p) {
     const repo = await sandbox.resolve(p);
     try {
-      await fs3.access(path3.join(repo, ".git"));
+      await fs4.access(path3.join(repo, ".git"));
     } catch {
       throw new HttpError(400, "not a git repository");
     }
@@ -535,15 +883,15 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
   const routes = {
     [Routes.info]: async () => ({
       protocol: PROTOCOL_VERSION,
-      hostname: os2.hostname(),
-      platform: os2.platform(),
+      hostname: os3.hostname(),
+      platform: os3.platform(),
       root: sandbox.root,
-      user: os2.userInfo().username,
+      user: os3.userInfo().username,
       shell: process.env.SHELL || null
     }),
     [Routes.fsList]: async (url) => {
       const dir = await sandbox.resolve(url.searchParams.get("path"));
-      const names = await fs3.readdir(dir);
+      const names = await fs4.readdir(dir);
       const entries = (await Promise.all(names.map((n) => describe(path3.join(dir, n), n).catch(() => null)))).filter(Boolean);
       return { path: dir, entries };
     },
@@ -553,7 +901,7 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
     },
     [Routes.fsRead]: async (url, req, res) => {
       const p = await sandbox.resolve(url.searchParams.get("path"));
-      const stat = await fs3.stat(p);
+      const stat = await fs4.stat(p);
       if (!stat.isFile()) throw new HttpError(400, "not a file");
       res.writeHead(200, { "content-type": "application/octet-stream", "content-length": stat.size });
       await pipeline(createReadStream(p), res);
@@ -563,24 +911,24 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
       const tmp = `${p}.vsremote-${process.pid}-${Date.now()}.tmp`;
       try {
         await pipeline(req, createWriteStream(tmp));
-        await fs3.rename(tmp, p);
+        await fs4.rename(tmp, p);
       } catch (e) {
-        await fs3.rm(tmp, { force: true });
+        await fs4.rm(tmp, { force: true });
         throw e;
       }
       return describe(p, path3.basename(p));
     },
     [Routes.fsMkdir]: async (url) => {
-      await fs3.mkdir(await sandbox.resolve(url.searchParams.get("path"), { allowMissing: true }), { recursive: true });
+      await fs4.mkdir(await sandbox.resolve(url.searchParams.get("path"), { allowMissing: true }), { recursive: true });
       return {};
     },
     [Routes.fsRename]: async (url, req) => {
       const { from, to } = await readJson(req);
-      await fs3.rename(await sandbox.resolveChild(from), await sandbox.resolveChild(to, { allowMissing: true }));
+      await fs4.rename(await sandbox.resolveChild(from), await sandbox.resolveChild(to, { allowMissing: true }));
       return {};
     },
     [Routes.fsDelete]: async (url) => {
-      await fs3.rm(await sandbox.resolveChild(url.searchParams.get("path")), { recursive: true });
+      await fs4.rm(await sandbox.resolveChild(url.searchParams.get("path")), { recursive: true });
       return {};
     },
     [Routes.gitRepos]: async () => ({ repos: await findRepos(sandbox.root) }),
@@ -622,6 +970,74 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
     [Routes.gitPull]: async (url, req) => ({ output: await pull(await repoOf((await readJson(req)).repo)) }),
     [Routes.gitPush]: async (url, req) => ({ output: await push(await repoOf((await readJson(req)).repo)) }),
     [Routes.termList]: async () => ({ sessions: sessions.list() }),
+    [Routes.portsList]: async () => ({ ports: await listPorts(shellPids()) }),
+    [Routes.portsKill]: async (url, req) => {
+      const { pid, force } = await readJson(req);
+      await killListener(pid, { force: force === true, shells: shellPids() });
+      return {};
+    },
+    [Routes.previewList]: async () => {
+      if (!preview) throw new HttpError(404, "previews need a tunnel");
+      return previews();
+    },
+    [Routes.previewOpen]: async (url, req) => {
+      const port2 = previewPort((await readJson(req)).port, server.address()?.port);
+      let proxy = proxies.get(port2);
+      if (!proxy) {
+        proxy = new InspectingProxy(port2);
+        await proxy.listen();
+        proxies.set(port2, proxy);
+      }
+      try {
+        await preview.forward(proxy.port);
+      } catch (e) {
+        throw new HttpError(502, e.message);
+      }
+      return previews();
+    },
+    [Routes.previewClose]: async (url) => {
+      const port2 = previewPort(url.searchParams.get("port"), server.address()?.port);
+      const proxy = proxies.get(port2);
+      if (proxy) await preview.unforward(proxy.port);
+      return previews();
+    },
+    [Routes.previewShare]: async (url, req) => {
+      const { port: value, hours } = await readJson(req);
+      const proxy = previewed(previewPort(value, server.address()?.port));
+      if (!Number.isInteger(hours) || hours < 1 || hours > 720) throw new HttpError(400, "hours must be 1-720");
+      try {
+        await preview.share(proxy.port, hours);
+      } catch (e) {
+        throw new HttpError(502, e.message);
+      }
+      return previews();
+    },
+    [Routes.previewUnshare]: async (url) => {
+      const proxy = proxies.get(previewPort(url.searchParams.get("port"), server.address()?.port));
+      try {
+        if (proxy) await preview.unshare(proxy.port);
+      } catch (e) {
+        throw new HttpError(502, e.message);
+      }
+      return previews();
+    },
+    [Routes.previewRequests]: async (url) => ({
+      requests: inspected(url.searchParams.get("port")).list(parseInt(url.searchParams.get("after"), 10) || 0)
+    }),
+    [Routes.previewRequest]: async (url) => {
+      const entry2 = inspected(url.searchParams.get("port")).get(parseInt(url.searchParams.get("id"), 10));
+      if (!entry2) throw new HttpError(404, "no such request (only the latest 200 are kept)");
+      return detail(entry2);
+    },
+    [Routes.previewRequestsClear]: async (url) => {
+      inspected(url.searchParams.get("port")).clear();
+      return {};
+    },
+    [Routes.tunnelStatus]: async () => {
+      const status2 = await tunnelStatus2?.();
+      if (!status2) throw new HttpError(404, "this agent runs without a tunnel");
+      return status2;
+    },
     [Routes.tunnelToken]: async () => {
       const issued = await handoff.issue();
       if (!issued) throw new HttpError(404, "this tunnel is anonymous");
@@ -634,7 +1050,7 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
       return {};
     }
   };
-  const server = http.createServer(async (req, res) => {
+  const server = http2.createServer(async (req, res) => {
     const url = new URL(req.url, "http://localhost");
     if (req.method === "GET" && url.pathname === "/") {
       res.writeHead(200, {
@@ -708,18 +1124,21 @@ function createAgentServer({ token, root: root2, tunnelToken = async () => null
     }
     wss.handleUpgrade(req, socket, head, (ws) => session.attach(ws));
   });
-  server.on("close", () => sessions.killAll());
+  server.on("close", () => {
+    sessions.killAll();
+    for (const proxy of proxies.values()) proxy.close();
+  });
   server.killAllSessions = () => sessions.killAll();
   return server;
 }
 
 // src/devtunnel.js
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 import { createHash } from "node:crypto";
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import path4 from "node:path";
 import { promisify } from "node:util";
-var run = promisify(execFile2);
+var run2 = promisify(execFile3);
 var DOWNLOAD_BASE = "https://tunnelsassetsprod.blob.core.windows.net/cli";
 var BUILDS = {
   "darwin-arm64": "osx-arm64-devtunnel",
@@ -731,8 +1150,8 @@ var MICROSOFT_TEAM_ID = "UBF8T346G9";
 var REFRESH_INTERVAL_MS = 24 * 36e5;
 function executable(file) {
   try {
-    fs4.accessSync(file, fs4.constants.X_OK);
-    return fs4.statSync(file).isFile();
+    fs5.accessSync(file, fs5.constants.X_OK);
+    return fs5.statSync(file).isFile();
   } catch {
     return false;
   }
@@ -761,7 +1180,7 @@ async function ensureDevtunnel({ dir, progress }) {
   const metaFile = path4.join(dir, "devtunnel.json");
   let meta = {};
   try {
-    meta = JSON.parse(fs4.readFileSync(metaFile, "utf8"));
+    meta = JSON.parse(fs5.readFileSync(metaFile, "utf8"));
   } catch {
   }
   const installed = executable(bin);
@@ -772,7 +1191,7 @@ async function ensureDevtunnel({ dir, progress }) {
       const head = await fetch(url, { method: "HEAD", signal: AbortSignal.timeout(3e3) });
       const lastModified = head.headers.get("last-modified");
       if (head.ok && lastModified && lastModified === meta.lastModified) {
-        fs4.writeFileSync(metaFile, JSON.stringify({ ...meta, checkedAt: Date.now() }));
+        fs5.writeFileSync(metaFile, JSON.stringify({ ...meta, checkedAt: Date.now() }));
         return bin;
       }
     } catch {
@@ -783,12 +1202,12 @@ async function ensureDevtunnel({ dir, progress }) {
   return bin;
 }
 async function download(url, bin, metaFile, progress) {
-  fs4.mkdirSync(path4.dirname(bin), { recursive: true, mode: 448 });
+  fs5.mkdirSync(path4.dirname(bin), { recursive: true, mode: 448 });
   const res = await fetch(url, { signal: AbortSignal.timeout(12e4) });
   if (!res.ok || !res.body) throw new Error(`Downloading devtunnel failed: HTTP ${res.status} from ${url}`);
   const total = Number(res.headers.get("content-length")) || 0;
   const tmp = `${bin}.${process.pid}.download`;
-  const out = fs4.createWriteStream(tmp, { mode: 493 });
+  const out = fs5.createWriteStream(tmp, { mode: 493 });
   const md5 = createHash("md5");
   let received = 0;
   try {
@@ -801,41 +1220,224 @@ async function download(url, bin, metaFile, progress) {
     await new Promise((resolve, reject) => out.end((e) => e ? reject(e) : resolve()));
     if (total && received !== total) throw new Error(`devtunnel download was cut short (${received} of ${total} bytes)`);
     await verify(tmp, md5.digest("base64"), res.headers.get("content-md5"));
-    fs4.chmodSync(tmp, 493);
-    fs4.renameSync(tmp, bin);
+    fs5.chmodSync(tmp, 493);
+    fs5.renameSync(tmp, bin);
   } catch (e) {
     out.destroy();
-    fs4.rmSync(tmp, { force: true });
+    fs5.rmSync(tmp, { force: true });
     throw e;
   }
-  fs4.writeFileSync(metaFile, JSON.stringify({ lastModified: res.headers.get("last-modified"), checkedAt: Date.now() }));
+  fs5.writeFileSync(metaFile, JSON.stringify({ lastModified: res.headers.get("last-modified"), checkedAt: Date.now() }));
 }
 async function verify(file, md5, expectedMd5) {
   if (expectedMd5 && md5 !== expectedMd5) throw new Error("devtunnel download is corrupt (MD5 mismatch)");
   if (process.platform !== "darwin") return;
   try {
-    await run("codesign", ["--verify", "--strict", file]);
-    const { stderr } = await run("codesign", ["-dv", file]);
+    await run2("codesign", ["--verify", "--strict", file]);
+    const { stderr } = await run2("codesign", ["-dv", file]);
     if (!stderr.includes(`TeamIdentifier=${MICROSOFT_TEAM_ID}`)) throw new Error("not signed by Microsoft");
   } catch (e) {
     throw new Error(`devtunnel download failed its signature check: ${e.message}`);
   }
 }
 
+// src/preview.js
+import { spawn } from "node:child_process";
+var HOST_READY_TIMEOUT_MS = 3e4;
+var TOKEN_REUSE_MS = 12 * 36e5;
+var PreviewTunnel = class {
+  #queue = Promise.resolve();
+  #tunnelId = null;
+  /** @type {{ child: import('node:child_process').ChildProcess, urls: Map<number, string> } | null} */
+  #host = null;
+  #ports = /* @__PURE__ */ new Set();
+  /** port -> ms since the epoch when its public access ends */
+  #shares = /* @__PURE__ */ new Map();
+  #token = null;
+  /**
+   * @param {object} opts
+   * @param {(...args: string[]) => Promise<{ok: boolean, out: string}>} opts.devtunnel  runs the CLI
+   * @param {() => string} opts.command  the devtunnel executable, for `devtunnel host`
+   * @param {string} opts.description
+   * @param {string | undefined} opts.leftover  a preview tunnel from an earlier run, deleted on first use
+   * @param {(tunnelId: string | null) => void} opts.remember  persists the current tunnel id
+   * @param {(tunnelId: string) => Promise<{token: string, expiresAt: number}>} opts.mintToken
+   */
+  constructor({ devtunnel: devtunnel2, command, description, leftover, remember, mintToken }) {
+    this.devtunnel = devtunnel2;
+    this.command = command;
+    this.description = description;
+    this.leftover = leftover;
+    this.remember = remember;
+    this.mintToken = mintToken;
+  }
+  /** Runs tunnel changes one at a time: each may restart the host. */
+  #serial(fn) {
+    const result = this.#queue.then(fn);
+    this.#queue = result.catch(() => {
+    });
+    return result;
+  }
+  list() {
+    const now = Date.now();
+    return [...this.#host?.urls ?? []].map(([port2, url]) => {
+      const until = this.#shares.get(port2);
+      return { port: port2, url, sharedUntil: until > now ? until : null };
+    }).sort((a, b) => a.port - b.port);
+  }
+  /**
+   * Lets anyone with the port's link open it, without signing in, for `hours`. Only that port of
+   * the preview tunnel: the agent's own tunnel, and its shell, stay private. The relay ends it
+   * on time by itself; `unshare` ends it sooner.
+   */
+  share(port2, hours) {
+    return this.#serial(async () => {
+      if (!this.#host?.urls.has(port2)) throw new Error(`port ${port2} is not being previewed`);
+      await this.devtunnel("access", "reset", this.#tunnelId, "-p", String(port2));
+      const res = await this.devtunnel(
+        "access",
+        "create",
+        this.#tunnelId,
+        "-p",
+        String(port2),
+        "--anonymous",
+        "--expiration",
+        `${hours}h`,
+        "--json"
+      );
+      if (!res.ok) throw new Error(`devtunnel access create failed: ${res.out.trim()}`);
+      const entries = JSON.parse(res.out.slice(res.out.indexOf("{"))).accessControlEntries ?? [];
+      const until = Date.parse(entries.find((e) => e.type === "Anonymous")?.expiration);
+      this.#shares.set(port2, Number.isFinite(until) ? until : Date.now() + hours * 36e5);
+    });
+  }
+  unshare(port2) {
+    return this.#serial(async () => {
+      if (!this.#shares.delete(port2) || !this.#tunnelId) return;
+      const res = await this.devtunnel("access", "reset", this.#tunnelId, "-p", String(port2));
+      if (!res.ok) throw new Error(`devtunnel access reset failed: ${res.out.trim()}`);
+    });
+  }
+  /** @returns {Promise<{port: number, url: string}>} */
+  forward(port2) {
+    return this.#serial(async () => {
+      const url = this.#host?.urls.get(port2);
+      if (url) return { port: port2, url };
+      const id = await this.#ensureTunnel();
+      const res = await this.devtunnel("port", "create", id, "-p", String(port2), "--protocol", "http");
+      if (!res.ok && !/already exists|conflict/i.test(res.out)) throw new Error(`devtunnel port create failed: ${res.out.trim()}`);
+      this.#ports.add(port2);
+      try {
+        await this.#restartHost();
+      } catch (e) {
+        this.#ports.delete(port2);
+        throw e;
+      }
+      const forwarded = this.#host?.urls.get(port2);
+      if (!forwarded) throw new Error(`devtunnel host did not forward port ${port2}`);
+      return { port: port2, url: forwarded };
+    });
+  }
+  unforward(port2) {
+    return this.#serial(async () => {
+      if (!this.#ports.delete(port2) || !this.#tunnelId) return;
+      this.#shares.delete(port2);
+      await this.devtunnel("port", "delete", this.#tunnelId, "-p", String(port2));
+      if (this.#ports.size) await this.#restartHost();
+      else this.#stopHost();
+    });
+  }
+  /** A connect token for the preview tunnel, or null before anything is forwarded. */
+  async token() {
+    if (!this.#tunnelId) return null;
+    if (!this.#token || this.#token.expiresAt - Date.now() < TOKEN_REUSE_MS) {
+      this.#token = await this.mintToken(this.#tunnelId);
+    }
+    return this.#token;
+  }
+  /** Stops hosting; the tunnel is deleted on the next run's first preview. */
+  stop() {
+    this.#stopHost();
+  }
+  async #ensureTunnel() {
+    if (this.#tunnelId) return this.#tunnelId;
+    if (this.leftover) await this.devtunnel("delete", this.leftover, "-f");
+    const created = await this.devtunnel(
+      "create",
+      "--expiration",
+      "1d",
+      "-d",
+      this.description,
+      "--labels",
+      "coderemote-preview",
+      "--json"
+    );
+    if (!created.ok) throw new Error(`devtunnel create failed: ${created.out.trim()}`);
+    const id = JSON.parse(created.out.slice(created.out.indexOf("{"))).tunnel?.tunnelId;
+    if (!id) throw new Error(`could not parse tunnel id from:
+${created.out}`);
+    this.#tunnelId = id;
+    this.leftover = void 0;
+    this.remember(id);
+    return id;
+  }
+  /** Starts a host with the current ports; once it's ready, the old one (already displaced) is killed. */
+  async #restartHost() {
+    const old = this.#host;
+    const next = await this.#startHost();
+    this.#host = next;
+    old?.child.kill();
+  }
+  #startHost() {
+    return new Promise((resolve, reject) => {
+      const child = spawn(this.command(), ["host", this.#tunnelId], { stdio: ["ignore", "pipe", "pipe"] });
+      const urls = /* @__PURE__ */ new Map();
+      let log2 = "";
+      const timer = setTimeout(() => {
+        child.kill();
+        reject(new Error(`devtunnel host did not get ready:
+${log2}`));
+      }, HOST_READY_TIMEOUT_MS);
+      const onData = (d) => {
+        log2 += d;
+        for (const m of log2.matchAll(/https:\/\/([a-z0-9]+)-(\d+)\.([a-z0-9.]*devtunnels\.ms)/g)) {
+          urls.set(parseInt(m[2], 10), m[0]);
+        }
+        if (/Ready to accept connections/.test(log2)) {
+          clearTimeout(timer);
+          resolve({ child, urls });
+        }
+      };
+      child.stdout.on("data", onData);
+      child.stderr.on("data", onData);
+      child.on("exit", (code) => {
+        clearTimeout(timer);
+        reject(new Error(`devtunnel host exited (${code}):
+${log2}`));
+        if (this.#host?.child === child) this.#host = null;
+      });
+    });
+  }
+  #stopHost() {
+    this.#host?.child.kill();
+    this.#host = null;
+  }
+};
+
 // src/registry.js
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import path5 from "node:path";
 var AgentRegistry = class {
   constructor(dir) {
     this.dir = dir;
   }
   register({ port: port2, root: root2, url }) {
-    fs5.mkdirSync(this.dir, { recursive: true, mode: 448 });
+    fs6.mkdirSync(this.dir, { recursive: true, mode: 448 });
     const file = this.#file(port2);
-    fs5.writeFileSync(file, JSON.stringify({ pid: process.pid, port: port2, root: root2, url, startedAt: Date.now() }), { mode: 384 });
+    fs6.writeFileSync(file, JSON.stringify({ pid: process.pid, port: port2, root: root2, url, startedAt: Date.now() }), { mode: 384 });
     const cleanup = () => {
       try {
-        if (JSON.parse(fs5.readFileSync(file, "utf8")).pid === process.pid) fs5.rmSync(file);
+        if (JSON.parse(fs6.readFileSync(file, "utf8")).pid === process.pid) fs6.rmSync(file);
       } catch {
       }
     };
@@ -846,7 +1448,7 @@ var AgentRegistry = class {
   list() {
     let names = [];
     try {
-      names = fs5.readdirSync(this.dir).filter((n) => n.endsWith(".json"));
+      names = fs6.readdirSync(this.dir).filter((n) => n.endsWith(".json"));
     } catch {
       return [];
     }
@@ -854,11 +1456,11 @@ var AgentRegistry = class {
     for (const name of names) {
       const file = path5.join(this.dir, name);
       try {
-        const agent = JSON.parse(fs5.readFileSync(file, "utf8"));
+        const agent = JSON.parse(fs6.readFileSync(file, "utf8"));
         process.kill(agent.pid, 0);
         agents.push(agent);
       } catch {
-        fs5.rmSync(file, { force: true });
+        fs6.rmSync(file, { force: true });
       }
     }
     return agents.sort((a, b) => a.port - b.port);
@@ -868,6 +1470,65 @@ var AgentRegistry = class {
   }
 };
 
+// src/tunnel-status.js
+var MACHINE_LABEL = "coderemote";
+var CACHE_MS = 15e3;
+function parse(out) {
+  return JSON.parse(out.slice(out.indexOf("{")));
+}
+function machineName(description) {
+  return (description || "").replace(/^(coderemote|vsremote)\s+/, "").replace(/\.local$/, "") || null;
+}
+function machine(tunnel, current) {
+  return {
+    id: tunnel.tunnelId,
+    name: machineName(tunnel.description),
+    // The agent's address, the same URL its pairing link carries.
+    url: tunnel.ports?.[0]?.portUri?.replace(/\/$/, "") ?? null,
+    // This agent is answering, so its own tunnel is hosted: the service's count lags a fresh start.
+    online: current || tunnel.hostConnections > 0,
+    current
+  };
+}
+function tunnelStatus({ devtunnel: devtunnel2, tunnelId, account, anonymous: anonymous2, preview }) {
+  let cached = null;
+  return async () => {
+    const id = tunnelId();
+    if (!id) return null;
+    if (cached && Date.now() - cached.at < CACHE_MS) return { ...cached.value, previewPorts: preview?.list().length ?? 0 };
+    const [own, listed] = await Promise.all([
+      devtunnel2("show", id, "--json"),
+      devtunnel2("list", "--labels", MACHINE_LABEL, "--json")
+    ]);
+    if (!own.ok) throw new Error(`devtunnel show failed: ${own.out.trim()}`);
+    const tunnel = parse(own.out).tunnel;
+    const others = listed.ok ? (parse(listed.out).tunnels ?? []).filter((t) => t.tunnelId !== id) : [];
+    const shown = await Promise.all(
+      others.map(async (t) => {
+        const res = await devtunnel2("show", t.tunnelId, "--json");
+        return res.ok ? parse(res.out).tunnel : null;
+      })
+    );
+    const machines = [machine(tunnel, true), ...shown.filter(Boolean).map((t) => machine(t, false))];
+    const value = {
+      account: account() ?? null,
+      tunnel: {
+        id,
+        url: machine(tunnel, true).url,
+        access: anonymous2 ? "anonymous" : "private",
+        // "30 days": pushed back every time `coderemote up` starts.
+        expiration: tunnel.tunnelExpiration ?? null,
+        connections: tunnel.clientConnections ?? 0,
+        uploaded: tunnel.uploadTotal ?? null,
+        downloaded: tunnel.downloadTotal ?? null
+      },
+      machines
+    };
+    cached = { at: Date.now(), value };
+    return { ...value, previewPorts: preview?.list().length ?? 0 };
+  };
+}
+
 // src/spinner.js
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var dim = (s) => `\x1B[2m${s}\x1B[22m`;
@@ -902,8 +1563,8 @@ var Spinner = class {
     this.timer = setInterval(() => this.render(FRAMES[++frame % FRAMES.length]), 80);
   }
   /** Extra status shown after the step's text while it runs, e.g. a download percentage. */
-  update(detail) {
-    this.detail = detail;
+  update(detail2) {
+    this.detail = detail2;
   }
   succeed() {
     this.finish(green("\u2714"));
@@ -921,8 +1582,8 @@ var Spinner = class {
     this.text = null;
   }
   render(frame) {
-    const detail = this.detail ? ` ${this.detail}` : "";
-    this.stream.write(`\r\x1B[2K  ${cyan(frame)} ${this.text}${detail} ${dim(this.elapsed())}`);
+    const detail2 = this.detail ? ` ${this.detail}` : "";
+    this.stream.write(`\r\x1B[2K  ${cyan(frame)} ${this.text}${detail2} ${dim(this.elapsed())}`);
   }
   finish(mark) {
     if (!this.text) return;
@@ -937,18 +1598,68 @@ var Spinner = class {
   }
 };
 
+// src/vscode-tunnel.js
+import { execFile as execFile4, spawn as spawn2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var run3 = promisify2(execFile4);
+function findCode() {
+  return process.env.CODEREMOTE_CODE || onPath("code");
+}
+async function codeTunnelSignedIn(code) {
+  try {
+    const { stdout } = await run3(code, ["tunnel", "user", "show"]);
+    return /^logged in/im.test(stdout);
+  } catch {
+    return false;
+  }
+}
+function codeTunnelLogin(code) {
+  return new Promise((resolve) => {
+    spawn2(code, ["tunnel", "user", "login", "--provider", "github"], { stdio: "inherit" }).on("exit", resolve);
+  });
+}
+function hostCodeTunnel(code, root2, timeoutMs = 6e4) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(code, ["tunnel"], { cwd: root2, stdio: ["ignore", "pipe", "pipe"] });
+    let log2 = "";
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error(`code tunnel printed no vscode.dev link within ${timeoutMs / 1e3}s:
+${log2}`));
+    }, timeoutMs);
+    const onData = (d) => {
+      log2 += String(d).replace(/\x1b\[[0-9;]*m/g, "");
+      const m = log2.match(/https:\/\/vscode\.dev\/tunnel\/([^/\s]+)/);
+      if (!m) return;
+      clearTimeout(timer);
+      resolve({ child, url: `https://vscode.dev/tunnel/${m[1]}${encodeURI(root2)}` });
+    };
+    child.stdout.on("data", onData);
+    child.stderr.on("data", onData);
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    child.on("exit", (exitCode) => {
+      clearTimeout(timer);
+      reject(new Error(`code tunnel exited (${exitCode}):
+${log2}`));
+    });
+  });
+}
+
 // bin/coderemote.js
-var run2 = promisify2(execFile3);
-var CONFIG_DIR = path6.join(os3.homedir(), ".coderemote");
-var LEGACY_CONFIG_DIR = path6.join(os3.homedir(), ".vsremote");
-if (!fs6.existsSync(CONFIG_DIR) && fs6.existsSync(LEGACY_CONFIG_DIR)) fs6.renameSync(LEGACY_CONFIG_DIR, CONFIG_DIR);
+var run4 = promisify3(execFile5);
+var CONFIG_DIR = path6.join(os4.homedir(), ".coderemote");
+var LEGACY_CONFIG_DIR = path6.join(os4.homedir(), ".vsremote");
+if (!fs7.existsSync(CONFIG_DIR) && fs7.existsSync(LEGACY_CONFIG_DIR)) fs7.renameSync(LEGACY_CONFIG_DIR, CONFIG_DIR);
 var CONFIG_FILE = path6.join(CONFIG_DIR, "config.json");
 var DEFAULT_PORT = 31580;
 var spinner = new Spinner();
 function loadConfig() {
   let cfg2 = {};
   try {
-    cfg2 = JSON.parse(fs6.readFileSync(CONFIG_FILE, "utf8"));
+    cfg2 = JSON.parse(fs7.readFileSync(CONFIG_FILE, "utf8"));
   } catch {
   }
   if (!cfg2.token) {
@@ -958,11 +1669,11 @@ function loadConfig() {
   return cfg2;
 }
 function saveConfig(cfg2) {
-  fs6.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
-  fs6.writeFileSync(CONFIG_FILE, JSON.stringify(cfg2, null, 2), { mode: 384 });
+  fs7.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  fs7.writeFileSync(CONFIG_FILE, JSON.stringify(cfg2, null, 2), { mode: 384 });
 }
-function listen(token, port2, root2, tunnelToken) {
-  const server = createAgentServer({ token, root: root2, tunnelToken });
+function listen(token, port2, root2, tunnelToken, preview, status2) {
+  const server = createAgentServer({ token, root: root2, tunnelToken, preview, tunnelStatus: status2 });
   return new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(port2, "127.0.0.1", () => resolve(server));
@@ -973,19 +1684,19 @@ async function resolveDevtunnel() {
   let installing = false;
   DEVTUNNEL = await ensureDevtunnel({
     dir: path6.join(CONFIG_DIR, "bin"),
-    progress: (detail) => {
+    progress: (detail2) => {
       if (!installing) {
         installing = true;
         spinner.start("Installing devtunnel (Microsoft Dev Tunnels CLI, one time)");
       }
-      spinner.update(detail);
+      spinner.update(detail2);
     }
   });
   if (installing) spinner.succeed();
 }
 async function devtunnel(...args) {
   try {
-    const { stdout } = await run2(DEVTUNNEL, args);
+    const { stdout } = await run4(DEVTUNNEL, args);
     return { ok: true, out: stdout };
   } catch (e) {
     return { ok: false, out: `${e.stdout || ""}${e.stderr || ""}` || e.message };
@@ -999,7 +1710,7 @@ function loginArgs(opts = rest) {
 }
 function interactiveLogin(args) {
   return new Promise((resolve) => {
-    spawn(DEVTUNNEL, args, { stdio: "inherit" }).on("exit", resolve);
+    spawn3(DEVTUNNEL, args, { stdio: "inherit" }).on("exit", resolve);
   });
 }
 var LOGIN_NEEDED = /not logged in|login token expired|login required|please log ?in/i;
@@ -1031,7 +1742,7 @@ function applyAccess(tunnelId, anonymous2) {
 async function ensureTunnel(cfg2, port2, anonymous2) {
   if (cfg2.tunnelId) {
     const [updated, access] = await Promise.all([
-      devtunnel("update", cfg2.tunnelId, "--expiration", "30d"),
+      devtunnel("update", cfg2.tunnelId, "--expiration", "30d", "--add-labels", MACHINE_LABEL),
       applyAccess(cfg2.tunnelId, anonymous2)
     ]);
     if (updated.ok) {
@@ -1042,7 +1753,7 @@ ${access.out}`);
     if (!/not found/i.test(updated.out)) throw new Error(`devtunnel update failed:
 ${updated.out}`);
   }
-  const createArgs = ["create", "--expiration", "30d", "-d", `coderemote ${os3.hostname()}`, "--json"];
+  const createArgs = ["create", "--expiration", "30d", "-d", `coderemote ${os4.hostname()}`, "--labels", MACHINE_LABEL, "--json"];
   if (anonymous2) createArgs.push("--allow-anonymous");
   const created = await devtunnel(...createArgs);
   if (!created.ok) throw new Error(`devtunnel create failed:
@@ -1068,7 +1779,7 @@ ${res.out}`);
 }
 function hostTunnel(tunnelId, port2) {
   return new Promise((resolve, reject) => {
-    const child = spawn(DEVTUNNEL, ["host", tunnelId], { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn3(DEVTUNNEL, ["host", tunnelId], { stdio: ["ignore", "pipe", "pipe"] });
     let log2 = "";
     const onData = (d) => {
       log2 += d;
@@ -1081,13 +1792,16 @@ function hostTunnel(tunnelId, port2) {
 ${log2}`)));
   });
 }
-function printPairing(url, token, access) {
+function printPairing(url, token, access, vscodeUrl) {
   const pair = pairingUrl({ url, token });
   if (access) console.log(`  Access:  ${access}`);
-  console.log(`
-  Web:  ${webUrl({ url, token })}`);
-  console.log(`  App:  ${pair}
+  const label = (name) => `${name}:`.padEnd(vscodeUrl ? 9 : 4);
+  console.log("");
+  if (vscodeUrl) console.log(`  ${label("VS Code")}  ${vscodeUrl}`);
+  console.log(`  ${label("Web")}  ${webUrl({ url, token })}`);
+  console.log(`  ${label("App")}  ${pair}
 `);
+  if (vscodeUrl) console.log("  VS Code opens in the browser after signing in with the account of `code tunnel`.");
   console.log("  Scan with the iPhone Camera, or open either link on the phone:\n");
   qrcode.generate(pair, { small: true });
   console.log(
@@ -1095,6 +1809,37 @@ function printPairing(url, token, access) {
   );
   console.log("  Run `coderemote rotate-token` to revoke every paired device.\n");
 }
+async function startVSCodeTunnel() {
+  const code = findCode();
+  if (!code) {
+    console.error("--web needs VS Code's `code` command on PATH (in VS Code: Shell Command: Install 'code' command in PATH).");
+    return null;
+  }
+  if (!await codeTunnelSignedIn(code)) {
+    if (!process.stdin.isTTY) {
+      console.error("--web: VS Code tunnel is not signed in. Run `code tunnel user login`, then try again.");
+      return null;
+    }
+    console.error("Signing in to VS Code tunnels with GitHub...\n");
+    if (await codeTunnelLogin(code) !== 0) {
+      console.error("\n--web: sign-in failed. Run `code tunnel user login`, then try again.");
+      return null;
+    }
+  }
+  spinner.start("Starting VS Code tunnel");
+  try {
+    const { child, url } = await hostCodeTunnel(code, root);
+    spinner.succeed();
+    process.on("exit", () => child.kill());
+    return url;
+  } catch (e) {
+    spinner.fail();
+    console.error(`${e.message.trim()}
+`);
+    console.error("--web: run `code tunnel` once in a terminal (license, machine name), then try again.");
+    return null;
+  }
+}
 var USAGE = `Usage: coderemote <command> [options]
 
   up                   share this folder through a dev tunnel and print the pairing QR;
@@ -1111,7 +1856,9 @@ Options:
   --root DIR           folder to share (default: current folder)
   --port N             local port (default: ${DEFAULT_PORT})
   --allow-anonymous    up: skip the sign-in, the pairing token alone grants access
-                       (alias --no-auth)`;
+                       (alias --no-auth)
+  --web                up: also run \`code tunnel\` and print a vscode.dev link that opens
+                       this folder in VS Code in the browser (needs VS Code's \`code\`)`;
 var HELP_FLAGS = ["help", "--help", "-help", "-h"];
 var argv = process.argv.slice(2);
 var [cmd, ...rest] = argv.length === 0 || argv.some((a) => HELP_FLAGS.includes(a)) ? ["help"] : argv;
@@ -1134,9 +1881,22 @@ async function start({ tunnel }) {
   let server;
   let tunnelId;
   const tunnelToken = async () => tunnel && !anonymous && tunnelId ? connectToken(tunnelId) : null;
+  const preview = tunnel ? new PreviewTunnel({
+    devtunnel,
+    command: () => DEVTUNNEL,
+    description: `coderemote preview ${os4.hostname()}`,
+    leftover: cfg.previewTunnels?.[port],
+    remember: (id) => {
+      cfg.previewTunnels = { ...cfg.previewTunnels, [port]: id };
+      saveConfig(cfg);
+    },
+    mintToken: connectToken
+  }) : null;
+  let account;
+  const status2 = tunnel ? tunnelStatus({ devtunnel, tunnelId: () => tunnelId, account: () => account, anonymous, preview }) : null;
   spinner.start("Starting agent");
   try {
-    server = await listen(cfg.token, port, root, tunnelToken);
+    server = await listen(cfg.token, port, root, tunnelToken, preview, status2);
   } catch (e) {
     spinner.fail();
     if (e.code !== "EADDRINUSE") throw e;
@@ -1153,6 +1913,7 @@ async function start({ tunnel }) {
     await resolveDevtunnel();
     spinner.start("Checking dev tunnels sign-in");
     const user = await tunnelUser();
+    account = user;
     spinner.succeed();
     spinner.start("Connecting to the relay");
     const known = cfg.tunnelId;
@@ -1172,6 +1933,7 @@ async function start({ tunnel }) {
   registry.register({ port, root, url });
   const shutdown = () => {
     child?.kill();
+    preview?.stop();
     server.killAllSessions();
     server.close();
     process.exit(0);
@@ -1179,7 +1941,10 @@ async function start({ tunnel }) {
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
   process.on("SIGHUP", shutdown);
-  process.on("exit", () => child?.kill());
+  process.on("exit", () => {
+    child?.kill();
+    preview?.stop();
+  });
   return { url, access };
 }
 async function agentApi(agent, method, route, query = {}) {
@@ -1222,9 +1987,10 @@ Token: ${cfg.token}`);
       throw e;
     }
     const { url, access } = started;
+    const vscodeUrl = rest.includes("--web") ? await startVSCodeTunnel() : null;
     console.log(`
   Sharing: ${root}`);
-    printPairing(url, cfg.token, access);
+    printPairing(url, cfg.token, access, vscodeUrl);
     break;
   }
   case "status":