npm - conductor-remote - Versions diffs - 1.21.3 → 1.23.0 - Mend

conductor-remote 1.21.3 → 1.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/assets/{index-W8Wv8MfE.css → index-BL-O33Ca.css} +1 -1
package/dist/assets/{index-lrYsUtTg.js → index-BpxkVzXq.js} +15 -15
package/dist/index.html +2 -2
package/dist/sw.js +1 -1
package/dist-node/scripts/service.js +11 -43
package/dist-node/src/autoupdate.js +41 -5
package/dist-node/src/funnel-watchdog.js +201 -0
package/dist-node/src/server.js +4 -0
package/dist-node/src/tailscale.js +74 -0
package/package.json +1 -1

package/dist/index.html CHANGED Viewed

@@ -13,8 +13,8 @@
 		<title>Conductor Remote</title>
 		<!-- Runs before the module bundle so it can catch a stale shell that fails to boot. -->
 		<script src="/self-heal.js"></script>
-		<script type="module" crossorigin src="/assets/index-lrYsUtTg.js"></script>
-		<link rel="stylesheet" crossorigin href="/assets/index-W8Wv8MfE.css">
+		<script type="module" crossorigin src="/assets/index-BpxkVzXq.js"></script>
+		<link rel="stylesheet" crossorigin href="/assets/index-BL-O33Ca.css">
 	<link rel="manifest" href="/manifest.webmanifest"></head>
 	<body>
 		<div id="root"></div>

package/dist/sw.js CHANGED Viewed

	@@ -1 +1 @@
1	- if(!self.define){let e,i={};const s=(s,n)=>(s=new URL(s+".js",n).href,i[s]\|\|new Promise(i=>{if("document"in self){const e=document.createElement("script");e.src=s,e.onload=i,document.head.appendChild(e)}else e=s,importScripts(s),i()}).then(()=>{let e=i[s];if(!e)throw new Error(`Module ${s} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(i[o])return;let l={};const t=e=>s(e,o),c={module:{uri:o},exports:l,require:t};i[o]=Promise.all(n.map(e=>c[e]\|\|t(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"index.html",revision:"~~f6a6b88cfb756b0a9ff8c81573287244~~"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-~~lrYsUtTg~~.js",revision:null},{url:"assets/index-~~W8Wv8MfE~~.css",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});
1	+ if(!self.define){let e,i={};const s=(s,n)=>(s=new URL(s+".js",n).href,i[s]\|\|new Promise(i=>{if("document"in self){const e=document.createElement("script");e.src=s,e.onload=i,document.head.appendChild(e)}else e=s,importScripts(s),i()}).then(()=>{let e=i[s];if(!e)throw new Error(`Module ${s} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(i[o])return;let l={};const t=e=>s(e,o),c={module:{uri:o},exports:l,require:t};i[o]=Promise.all(n.map(e=>c[e]\|\|t(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"index.html",revision:"f8e519f4a8c664e338315a2129d6f59e"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-BpxkVzXq.js",revision:null},{url:"assets/index-BL-O33Ca.css",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});

package/dist-node/scripts/service.js CHANGED Viewed

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { packageRoot } from "../src/pkg-root.js";
+import { exposeStorePath, magicDnsName, normalizeExposeMode, relayPort, tailscaleBin } from "../src/tailscale.js";
 import { qrLines } from "./qr.js";
 const LABEL = 'no.adluna.conductor-remote';
 const projectDir = packageRoot(import.meta.dirname);
@@ -33,6 +34,8 @@ const FLAG_ENV = {
     '--write-strategy': 'WRITE_STRATEGY',
     '--auto-update': 'AUTO_UPDATE',
     '--auto-update-interval': 'AUTO_UPDATE_INTERVAL_MINUTES',
+    '--funnel-watchdog': 'FUNNEL_WATCHDOG',
+    '--funnel-watchdog-interval': 'FUNNEL_WATCHDOG_INTERVAL_SECONDS',
     '--db': 'CONDUCTOR_DB',
     '--workspaces': 'CONDUCTOR_WORKSPACES'
 };
@@ -137,6 +140,10 @@ function buildPlist() {
         envEntries.push(['AUTO_UPDATE', process.env.AUTO_UPDATE]);
     if (process.env.AUTO_UPDATE_INTERVAL_MINUTES)
         envEntries.push(['AUTO_UPDATE_INTERVAL_MINUTES', process.env.AUTO_UPDATE_INTERVAL_MINUTES]);
+    if (process.env.FUNNEL_WATCHDOG)
+        envEntries.push(['FUNNEL_WATCHDOG', process.env.FUNNEL_WATCHDOG]);
+    if (process.env.FUNNEL_WATCHDOG_INTERVAL_SECONDS)
+        envEntries.push(['FUNNEL_WATCHDOG_INTERVAL_SECONDS', process.env.FUNNEL_WATCHDOG_INTERVAL_SECONDS]);
     if (process.env.CONDUCTOR_DB)
         envEntries.push(['CONDUCTOR_DB', process.env.CONDUCTOR_DB]);
     if (process.env.CONDUCTOR_WORKSPACES)
@@ -207,53 +214,14 @@ function persistPinnedToken() {
         console.info(`  ⚠ could not persist --token (${err instanceof Error ? err.message : err})`);
     }
 }
-const RELAY_PORT = process.env.RELAY_PORT ?? '8787';
-/** Locate the tailscale CLI: PATH first, then the common macOS install locations. Null if absent. */
-function tailscaleBin() {
-    for (const bin of [
-        'tailscale',
-        '/opt/homebrew/bin/tailscale',
-        '/usr/local/bin/tailscale',
-        '/Applications/Tailscale.app/Contents/MacOS/Tailscale'
-    ]) {
-        try {
-            execFileSync(bin, ['version'], { stdio: 'pipe' });
-            return bin;
-        }
-        catch {
-            // try the next candidate
-        }
-    }
-    return null;
-}
-/** This node's MagicDNS name without the trailing dot, e.g. `mac.taila6dcd6.ts.net`. */
-function magicDnsName(bin) {
-    try {
-        const out = execFileSync(bin, ['status', '--json'], { encoding: 'utf8', stdio: 'pipe' });
-        return (JSON.parse(out)?.Self?.DNSName ?? '').replace(/\.$/, '') || null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Where the chosen expose mode is persisted so a later bare `yarn deploy` keeps the same posture. */
-function exposeStorePath() {
-    return path.join(os.homedir(), 'Library', 'Application Support', 'conductor-remote', 'expose');
-}
-function normalizeMode(raw) {
-    const v = raw?.trim().toLowerCase();
-    if (v === 'public' || v === 'funnel')
-        return 'public';
-    if (v === 'tailnet' || v === 'serve' || v === 'private')
-        return 'tailnet';
-    return null;
-}
+const RELAY_PORT = relayPort();
 /**
  * Resolve the expose mode. Precedence: `EXPOSE` env (public|funnel / tailnet|serve|private) > persisted
  * choice > 'public' default. An explicit env value is persisted so re-deploys don't silently flip posture.
+ * (The read-only counterpart used by the runtime watchdog is readExposeMode() in src/tailscale.ts.)
  */
 function resolveExposeMode() {
-    const fromEnv = normalizeMode(process.env.EXPOSE);
+    const fromEnv = normalizeExposeMode(process.env.EXPOSE);
     if (fromEnv) {
         try {
             const file = exposeStorePath();
@@ -268,7 +236,7 @@ function resolveExposeMode() {
     if (process.env.EXPOSE)
         console.info(`  ⚠ unrecognized EXPOSE=${process.env.EXPOSE} — expected public|tailnet.`);
     try {
-        const saved = normalizeMode(fs.readFileSync(exposeStorePath(), 'utf8'));
+        const saved = normalizeExposeMode(fs.readFileSync(exposeStorePath(), 'utf8'));
         if (saved)
             return saved;
     }

package/dist-node/src/autoupdate.js CHANGED Viewed

@@ -105,6 +105,18 @@ function isNewer(candidate, base) {
     }
     return false;
 }
+/**
+ * The effective installed version: the newer of the version this process booted as (`CURRENT`) and
+ * what's on disk right now. A restart that raced npm's global write can boot us reading the pre-install
+ * `package.json`, so comparing the registry's `latest` against `CURRENT` alone re-declares an update we
+ * already applied to disk — and reinstall→restart→boot-stale loops, dropping every connected client on
+ * each restart (one release once became three restarts this way). Comparing against disk too closes that
+ * loop; the disk-skew heal then reloads us into the newer on-disk code.
+ */
+function installedVersion() {
+    const onDisk = diskVersion();
+    return onDisk && isNewer(onDisk, CURRENT) ? onDisk : CURRENT;
+}
 async function fetchLatest() {
     // The `/latest` sub-endpoint serves the full manifest as application/json; the abbreviated
     // `vnd.npm.install-v1+json` media type is only valid on the packument root and 406s here.
@@ -128,6 +140,23 @@ async function installLatest() {
         env: { ...process.env, npm_config_yes: 'true' }
     });
 }
+/**
+ * Block until the installed package.json on disk reports `want`, or `timeoutMs` elapses. npm's global
+ * swap can lag `execFile`'s resolve by a beat (nvm symlink/fs caching); restarting before disk reflects
+ * the install boots the successor into the *old* version, which then re-triggers the same update — the
+ * restart loop. Waiting makes the successor deterministically boot into `want`. Bounded so a mis-resolved
+ * install can't hang the updater; the 60s disk-skew heal is the backstop if this returns false.
+ */
+async function waitForDiskVersion(want, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (diskVersion() === want)
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise(resolve => setTimeout(resolve, 200));
+    }
+}
 function log(msg) {
     console.info(`[auto-update] ${msg}`);
 }
@@ -175,24 +204,31 @@ function restartIfDiskSkewed() {
 }
 let inFlight = false;
 async function runCheck(mode) {
-    if (inFlight)
+    if (inFlight || restarting)
         return;
     inFlight = true;
     try {
         const latest = await fetchLatest();
         status.latest = latest;
         status.checkedAt = Date.now();
-        status.available = latest != null && isNewer(latest, CURRENT);
+        // Compare against the effective installed version (the boot version, or a newer one already on
+        // disk), never `CURRENT` alone — otherwise a restart that booted us stale reinstalls a version disk
+        // already has, looping. See installedVersion().
+        const base = installedVersion();
+        status.available = latest != null && isNewer(latest, base);
         status.lastError = null;
         if (!status.available || latest == null)
             return;
         if (mode === 'check') {
-            log(`update available: ${CURRENT} → ${latest} (AUTO_UPDATE=check — not installing)`);
+            log(`update available: ${base} → ${latest} (AUTO_UPDATE=check — not installing)`);
             return;
         }
-        log(`updating ${CURRENT} → ${latest} via \`npm i -g ${NAME}@latest\`…`);
+        log(`updating ${base} → ${latest} via \`npm i -g ${NAME}@latest\`…`);
         await installLatest();
-        scheduleRestart(`installed ${latest}`);
+        // Restart only once the install is visible on disk, so the successor boots into `latest` instead of
+        // re-reading the pre-install version and re-triggering this update (the restart loop).
+        const settled = await waitForDiskVersion(latest);
+        scheduleRestart(settled ? `installed ${latest}` : `installed ${latest} (disk still settling)`);
     }
     catch (err) {
         status.lastError = err instanceof Error ? err.message : String(err);

package/dist-node/src/funnel-watchdog.js ADDED Viewed

@@ -0,0 +1,201 @@
+/**
+ * Keeps the phone's public URL actually reachable.
+ *
+ * Tailscale Funnel exposes the loopback relay to the internet by having tailscaled hold a registration
+ * with Tailscale's Funnel *ingress* relays; public clients hit those relays, which forward the TLS stream
+ * to this node. That registration goes STALE after a network transition (Wi-Fi ⇄ iPhone hotspot, a new
+ * DHCP lease, sleep/wake) — especially behind the symmetric NAT common at offices, where the node's
+ * public endpoint keeps moving. When it does, `tailscale funnel status` still cheerfully reports "Funnel
+ * on" and tailscaled keeps its local :443 listener up, but the ingress can no longer reach the node: the
+ * phone (and any desktop tab) sits on "Offline — retrying" until someone manually re-runs `funnel reset`.
+ * Nothing self-heals it. (See FINDINGS / the funnel-ingress-stale note.)
+ *
+ * So this watchdog does NOT trust any local funnel status. It probes the REAL public path end-to-end —
+ * resolving the node's MagicDNS name against a *public* resolver to get the ingress IPs (never the tailnet
+ * 100.x address, which would mask the break exactly like a `--resolve` to the node does), then an HTTPS
+ * GET /health pinned to an ingress IP with the node's SNI. A healthy funnel answers; a stale one fails the
+ * TLS/HTTP exchange entirely. After a few consecutive failures — and only when the ingress is TCP-reachable,
+ * so a plain internet outage doesn't trigger a pointless reset — it re-registers with
+ * `tailscale funnel reset && tailscale funnel --bg --yes <port>`, then waits for propagation. The periodic
+ * probe doubles as keepalive traffic through the ingress, which also helps hold the mapping open.
+ *
+ * Gated like the self-updater: only the launchd-managed daemon (`CONDUCTOR_REMOTE_MANAGED=1`) in public
+ * (Funnel) posture runs it. `FUNNEL_WATCHDOG=off` disables; `on` forces it where a tailscale CLI + Funnel
+ * posture exist. Stdlib + global fetch/dns/https only — no runtime deps, strip-clean.
+ */
+import { execFile } from 'node:child_process';
+import { Resolver } from 'node:dns/promises';
+import https from 'node:https';
+import net from 'node:net';
+import { promisify } from 'node:util';
+import { magicDnsName, readExposeMode, relayPort, tailscaleBin } from "./tailscale.js";
+const execFileP = promisify(execFile);
+const PROBE_PATH = '/health'; // unauthenticated 200 on the relay — no token needed to prove reachability
+const PROBE_TIMEOUT_MS = 8000;
+const TCP_TIMEOUT_MS = 4000;
+const FIRST_DELAY_MS = 20 * 1000; // let the relay + funnel settle after a (re)start before the first probe
+// Consecutive failed probes before we re-register. A single miss is often a transient blip; a stale ingress
+// stays broken until reset, so waiting for N in a row costs a little detection latency to avoid a needless
+// funnel reset (which itself briefly drops clients). ~N×interval of confirmed-down before acting.
+const FAIL_THRESHOLD = 3;
+const HEAL_COOLDOWN_MS = 120 * 1000; // min gap between re-registrations, so a persistent fault can't hammer funnel
+const POST_HEAL_MS = 60 * 1000; // after a reset, give the control plane time to propagate before re-probing
+/** Probe cadence. Frequent enough to detect a stale ingress within a couple minutes and to keep the mapping warm. */
+function resolveIntervalMs() {
+    const raw = Number(process.env.FUNNEL_WATCHDOG_INTERVAL_SECONDS);
+    const seconds = Number.isFinite(raw) && raw > 0 ? raw : 60;
+    return Math.max(seconds, 15) * 1000;
+}
+function log(msg) {
+    console.info(`[funnel-watchdog] ${msg}`);
+}
+function wantEnabled() {
+    const raw = process.env.FUNNEL_WATCHDOG?.trim().toLowerCase();
+    if (raw === 'off' || raw === 'false' || raw === '0')
+        return false;
+    if (raw === 'on' || raw === 'true' || raw === '1')
+        return true;
+    return process.env.CONDUCTOR_REMOTE_MANAGED === '1'; // default: only the managed daemon
+}
+/**
+ * Public A records for `host` — the Funnel ingress IPs. Queried against public resolvers so MagicDNS on
+ * this node can't answer with the tailnet 100.x address (which would make every probe hit the node directly
+ * and never see an ingress break). Falls back to the system resolver only if the public query fails.
+ */
+async function ingressIps(host) {
+    try {
+        const r = new Resolver({ timeout: 4000, tries: 2 });
+        r.setServers(['1.1.1.1', '8.8.8.8']);
+        const ips = await r.resolve4(host);
+        if (ips.length)
+            return ips;
+    }
+    catch {
+        // public resolver blocked/unreachable — fall through to the system resolver
+    }
+    try {
+        const { lookup } = await import('node:dns/promises');
+        const all = await lookup(host, { all: true, family: 4 });
+        return all.map(a => a.address);
+    }
+    catch {
+        return [];
+    }
+}
+/** GET https://host<PROBE_PATH> but pinned to `ip` (an ingress relay) with SNI=host. Resolves the HTTP status
+ *  code; rejects if the TLS/HTTP exchange never completes — the signature of a stale ingress. */
+function probeVia(ip, host, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            host: ip,
+            port: 443,
+            servername: host, // SNI so the ingress routes to this node and the node's cert validates
+            path: PROBE_PATH,
+            method: 'GET',
+            headers: { host, 'user-agent': 'conductor-remote-funnel-watchdog' },
+            timeout: timeoutMs
+        }, res => {
+            res.resume(); // drain so the socket can close
+            resolve(res.statusCode ?? 0);
+        });
+        req.on('timeout', () => req.destroy(new Error('probe timeout')));
+        req.on('error', reject);
+        req.end();
+    });
+}
+/** True if a bare TCP connection to `ip:port` opens — i.e. the internet + ingress are reachable, isolating
+ *  "stale funnel stream" (heal-worthy) from "no connectivity" (nothing to fix, don't churn). */
+function tcpOpen(ip, port, timeoutMs) {
+    return new Promise(resolve => {
+        const socket = net.connect({ host: ip, port });
+        const finish = (ok) => {
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => finish(true));
+        socket.once('timeout', () => finish(false));
+        socket.once('error', () => finish(false));
+    });
+}
+async function reRegisterFunnel(bin, port) {
+    await execFileP(bin, ['funnel', 'reset'], { timeout: 15_000 });
+    await execFileP(bin, ['funnel', '--bg', '--yes', port], { timeout: 20_000 });
+}
+let fails = 0;
+let lastHealAt = 0;
+function schedule(fn, delayMs) {
+    setTimeout(fn, delayMs).unref();
+}
+async function tick(host, bin, port, intervalMs) {
+    const again = (delay) => schedule(() => void tick(host, bin, port, intervalMs), delay);
+    const ips = await ingressIps(host);
+    if (ips.length === 0) {
+        // Can't resolve the ingress at all (DNS down / offline) — can't confirm a fault, so never heal.
+        return again(intervalMs);
+    }
+    const ip = ips[0];
+    let healthy = false;
+    try {
+        const status = await probeVia(ip, host, PROBE_TIMEOUT_MS);
+        healthy = status > 0 && status < 500; // any real HTTP answer means the ingress reached the node
+    }
+    catch {
+        healthy = false;
+    }
+    if (healthy) {
+        if (fails > 0)
+            log(`ingress healthy again after ${fails} failed probe(s)`);
+        fails = 0;
+        return again(intervalMs);
+    }
+    fails++;
+    if (fails < FAIL_THRESHOLD)
+        return again(intervalMs);
+    // Confirmed down. Only re-register if the ingress is actually reachable (internet up) — otherwise it's a
+    // connectivity outage that will clear on its own, and a funnel reset would just churn.
+    const reachable = await tcpOpen(ip, 443, TCP_TIMEOUT_MS);
+    if (!reachable) {
+        log(`ingress ${ip} unreachable after ${fails} probes — looks offline, not re-registering`);
+        return again(intervalMs);
+    }
+    if (Date.now() - lastHealAt < HEAL_COOLDOWN_MS)
+        return again(intervalMs);
+    log(`funnel ingress stale (${fails} failed probes, ingress TCP-reachable) — re-registering: funnel reset && funnel --bg ${port}`);
+    try {
+        await reRegisterFunnel(bin, port);
+        lastHealAt = Date.now();
+        fails = 0;
+        log(`re-registered funnel; waiting ${POST_HEAL_MS / 1000}s for the ingress to propagate`);
+        return again(POST_HEAL_MS);
+    }
+    catch (err) {
+        log(`funnel re-register failed: ${err instanceof Error ? err.message.trim() : String(err)} — will retry`);
+        return again(intervalMs);
+    }
+}
+/** Start the funnel watchdog. Safe to call unconditionally — no-ops unless the gates pass. */
+export function startFunnelWatchdog() {
+    if (!wantEnabled())
+        return;
+    if (readExposeMode() !== 'public') {
+        // Funnel-specific: in tailnet (serve) posture there's no public ingress to keep alive.
+        if (process.env.FUNNEL_WATCHDOG)
+            log('skipped: expose posture is tailnet (serve), not public (funnel)');
+        return;
+    }
+    const bin = tailscaleBin();
+    if (!bin) {
+        log('skipped: tailscale CLI not found');
+        return;
+    }
+    const host = magicDnsName(bin);
+    if (!host) {
+        log('skipped: no MagicDNS name for this node');
+        return;
+    }
+    const port = relayPort();
+    const intervalMs = resolveIntervalMs();
+    log(`enabled; probing https://${host}${PROBE_PATH} via the public ingress every ${intervalMs / 1000}s (heal after ${FAIL_THRESHOLD} fails)`);
+    schedule(() => void tick(host, bin, port, intervalMs), FIRST_DELAY_MS);
+}

package/dist-node/src/server.js CHANGED Viewed

@@ -6,6 +6,7 @@ import zlib from 'node:zlib';
 import { startAutoUpdate, updateStatus } from "./autoupdate.js";
 import { loadConfig } from "./config.js";
 import { ConductorDb } from "./db.js";
+import { startFunnelWatchdog } from "./funnel-watchdog.js";
 import { workspaceDiff } from "./git.js";
 import { mergePr } from "./merge.js";
 import { attachPrStatus } from "./pr.js";
@@ -257,4 +258,7 @@ server.listen(cfg.port, cfg.host, () => {
     ].join('\n'));
     // Keep the managed global daemon current — no-ops for dev checkouts / unmanaged runs (see autoupdate.ts).
     startAutoUpdate();
+    // Keep the phone's public URL reachable — re-registers Funnel when its ingress goes stale after a
+    // network change. No-ops unless managed + public (Funnel) posture (see funnel-watchdog.ts).
+    startFunnelWatchdog();
 });

package/dist-node/src/tailscale.js ADDED Viewed

@@ -0,0 +1,74 @@
+/**
+ * Shared Tailscale helpers used by BOTH the deploy script (scripts/service.ts) and the runtime funnel
+ * watchdog (src/funnel-watchdog.ts). They must agree: the watchdog re-establishes Funnel with the same
+ * port and posture the deploy configured, so "how do we find tailscale / this node's public name / the
+ * expose mode" lives here once rather than drifting between deploy-time and runtime copies.
+ *
+ * Stdlib only, strip-clean (no transform-requiring syntax — see CLAUDE.md ▸ dev path).
+ */
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/** The relay's loopback port — what Funnel/Serve proxy to. Mirrors config.ts (`RELAY_PORT ?? 8787`). */
+export function relayPort() {
+    return String(process.env.RELAY_PORT ?? 8787);
+}
+/** Locate the tailscale CLI: PATH first, then the common macOS install locations. Null if absent. */
+export function tailscaleBin() {
+    for (const bin of [
+        'tailscale',
+        '/opt/homebrew/bin/tailscale',
+        '/usr/local/bin/tailscale',
+        '/Applications/Tailscale.app/Contents/MacOS/Tailscale'
+    ]) {
+        try {
+            execFileSync(bin, ['version'], { stdio: 'pipe' });
+            return bin;
+        }
+        catch {
+            // try the next candidate
+        }
+    }
+    return null;
+}
+/** This node's MagicDNS name without the trailing dot, e.g. `mac.taila6dcd6.ts.net`. Null if unknown. */
+export function magicDnsName(bin) {
+    try {
+        const out = execFileSync(bin, ['status', '--json'], { encoding: 'utf8', stdio: 'pipe' });
+        return (JSON.parse(out)?.Self?.DNSName ?? '').replace(/\.$/, '') || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Where the chosen expose mode is persisted (written by the deploy script; read-only here). */
+export function exposeStorePath() {
+    return path.join(os.homedir(), 'Library', 'Application Support', 'conductor-remote', 'expose');
+}
+export function normalizeExposeMode(raw) {
+    const v = raw?.trim().toLowerCase();
+    if (v === 'public' || v === 'funnel')
+        return 'public';
+    if (v === 'tailnet' || v === 'serve' || v === 'private')
+        return 'tailnet';
+    return null;
+}
+/**
+ * Read-only resolve of the expose posture: `EXPOSE` env > persisted choice > 'public' default. Unlike the
+ * deploy script's resolveExposeMode(), this never writes the persisted file — the runtime only observes.
+ */
+export function readExposeMode() {
+    const fromEnv = normalizeExposeMode(process.env.EXPOSE);
+    if (fromEnv)
+        return fromEnv;
+    try {
+        const saved = normalizeExposeMode(fs.readFileSync(exposeStorePath(), 'utf8'));
+        if (saved)
+            return saved;
+    }
+    catch {
+        // no saved choice yet
+    }
+    return 'public';
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.21.3",
+	"version": "1.23.0",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",