npm - conductor-remote - Versions diffs - 1.76.0 → 1.76.1 - Mend

conductor-remote 1.76.0 → 1.76.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md +6 -0
package/dist/assets/{index-C97AjnMr.js → index-B7l0pOim.js} +2 -2
package/dist/index.html +1 -1
package/dist/sw.js +1 -1
package/dist-node/scripts/service.js +151 -55
package/dist-node/src/funnel-watchdog.js +37 -1
package/dist-node/src/tailscale.js +69 -0
package/package.json +1 -1

package/dist/index.html CHANGED Viewed

@@ -13,7 +13,7 @@
 		<title>Conductor Remote</title>
 		<!-- Runs before the module bundle so it can catch a stale shell that fails to boot. -->
 		<script src="/self-heal.js"></script>
-		<script type="module" crossorigin src="/assets/index-C97AjnMr.js"></script>
+		<script type="module" crossorigin src="/assets/index-B7l0pOim.js"></script>
 		<link rel="stylesheet" crossorigin href="/assets/index-BnacVtpu.css">
 	<link rel="manifest" href="/manifest.webmanifest"></head>
 	<body>

package/dist/sw.js CHANGED Viewed

	@@ -1 +1 @@
1	- if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]\|\|new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(s[o])return;let c={};const l=e=>i(e,o),t={module:{uri:o},exports:c,require:l};s[o]=Promise.all(n.map(e=>t[e]\|\|l(e))).then(e=>(r(...e),c))}}define(["./workbox-9c191d2f"],function(e){"use strict";importScripts("/push-sw.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"push-sw.js",revision:"e7ef44deca46c0539e6ff7bba5eb815e"},{url:"index.html",revision:"~~db08ac43ea0b836457637a13fc35eb16~~"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-~~C97AjnMr~~.js",revision:null},{url:"assets/index-~~BnacVtpu~~.~~css~~",revision:null},{url:"apple-touch-icon.png",revision:"1127bb396b4648add53dce3f22c92aee"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a9b0d962686287452216492cd2247499"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});
1	+ if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]\|\|new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(s[o])return;let l={};const c=e=>i(e,o),t={module:{uri:o},exports:l,require:c};s[o]=Promise.all(n.map(e=>t[e]\|\|c(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";importScripts("/push-sw.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"push-sw.js",revision:"e7ef44deca46c0539e6ff7bba5eb815e"},{url:"index.html",revision:"b2d7edff3447d77e3f268d0e40abfcc1"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-BnacVtpu.css",revision:null},{url:"assets/index-B7l0pOim.js",revision:null},{url:"apple-touch-icon.png",revision:"1127bb396b4648add53dce3f22c92aee"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a9b0d962686287452216492cd2247499"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});

package/dist-node/scripts/service.js CHANGED Viewed

@@ -14,7 +14,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { installedServiceEnvironment, serviceEnvironmentWithSetting } from "../src/config.js";
 import { packageRoot } from "../src/pkg-root.js";
-import { driftWarningLines, exposeStorePath, magicDnsName, normalizeExposeMode, relayPort, tailscaleBin, writeUrlHost } from "../src/tailscale.js";
+import { driftWarningLines, exposeStorePath, FUNNEL_PORTS, freeServePort, magicDnsName, normalizeExposeMode, parseServeStatus, relayPort, relayServeState, serveUrl, tailscaleBin, writeUrlHost } from "../src/tailscale.js";
 import { qrLines } from "./qr.js";
 const LABEL = 'no.adluna.conductor-remote';
 const projectDir = packageRoot(import.meta.dirname);
@@ -264,35 +264,95 @@ function resolveExposeMode() {
     }
     return 'public';
 }
-/** Live serve/funnel state for this node: is the loopback proxy wired, and is Funnel (public) on? */
-function tailscaleState(bin, dns) {
-    if (!dns)
-        return { proxyOk: false, funnelOn: false };
+/**
+ * Live serve/funnel state for this node as it concerns the relay: the HTTPS port fronting it (any port, not
+ * only :443), whether that port is public, and which ports carry mounts that are not the relay's. A status
+ * that cannot be read counts as nothing fronting — the same answer the old reader gave, and one that only
+ * ever leads to a mount on a port nobody holds.
+ */
+function tailscaleState(bin, port = RELAY_PORT) {
     try {
         const out = execFileSync(bin, ['serve', 'status', '--json'], { encoding: 'utf8', stdio: 'pipe' });
-        const cfg = JSON.parse(out);
-        const key = `${dns}:443`;
-        const proxyOk = cfg?.Web?.[key]?.Handlers?.['/']?.Proxy === `http://127.0.0.1:${RELAY_PORT}`;
-        return { proxyOk, funnelOn: Boolean(cfg?.AllowFunnel?.[key]) };
+        return relayServeState(parseServeStatus(out), port);
     }
     catch {
-        return { proxyOk: false, funnelOn: false };
+        return relayServeState({}, port);
     }
 }
-/** Assert the tailnet-only `serve` proxy — used for tailnet mode and as the Funnel fallback. */
-function ensureServeOnly(bin, url, state) {
-    if (state.proxyOk && !state.funnelOn) {
-        console.info(`✓ tailscale serve fronts ${url} → 127.0.0.1:${RELAY_PORT} (tailnet-only)`);
-        return;
-    }
+/**
+ * The one Tailscale write here: `tailscale <serve|funnel> --bg --https=<port> <relay port>`. Always scoped
+ * to a port the relay owns outright or nobody holds — the callers check, this does not. Serving a port
+ * Funnel currently exposes drops that port's Funnel flag and touches no other port, which is what made
+ * the old `funnel reset` (every mount on the node, gone) unnecessary. Returns the CLI's error, or null.
+ */
+function mountRelay(bin, kind, port) {
     try {
-        execFileSync(bin, ['serve', '--bg', RELAY_PORT], { stdio: 'pipe' });
-        console.info(`✓ tailscale serve → ${url} proxies 127.0.0.1:${RELAY_PORT} (tailnet-only)`);
+        execFileSync(bin, [kind, '--bg', '--yes', `--https=${port}`, RELAY_PORT], { stdio: 'pipe' });
+        return null;
     }
     catch (err) {
-        console.info(`\n  ⚠ could not configure tailscale serve (${err instanceof Error ? err.message : err}). Run by hand:`);
-        console.info(`      tailscale serve --bg ${RELAY_PORT}`);
+        return err instanceof Error ? err.message.trim() : String(err);
+    }
+}
+function byHand(kind, port) {
+    return `tailscale ${kind} --bg --yes --https=${port} ${RELAY_PORT}`;
+}
+function describeTaken(state, port) {
+    return (state.taken.get(port) ?? []).join(', ');
+}
+/** A port the relay shares is left exactly as found: Funnel is per port, so a change would drag the rest along. */
+function leaveShared(url, state, want) {
+    console.info(`\n  ⚠ ${url} fronts the relay, but :${state.port} also carries ${state.shared.join(', ')}.`);
+    console.info(`    Funnel is per port, so making the relay ${want} would take those mounts along. Left as is.`);
+    console.info(`    To change it, move the relay to a port of its own:  ${byHand(want === 'public' ? 'funnel' : 'serve', '<port>')}`);
+}
+function refuseNoPort(state, candidates) {
+    const held = candidates.map(p => `:${p} → ${describeTaken(state, p)}`).join('; ');
+    console.info(`\n  ⚠ every port the relay could take already carries another service (${held}). Not touching them.`);
+    console.info(`    Free one, then run \`yarn deploy\` again — or mount by hand:  ${byHand('serve', '<port>')}`);
+}
+/**
+ * Assert a tailnet-only `serve` proxy in front of the relay — tailnet mode, and the fallback when Funnel is
+ * refused. Non-destructive by construction: a mapping is kept wherever it already lives (:443 or not), a
+ * shared port is reported rather than rewritten, and a fresh mount steps around any port someone else holds.
+ * The order of candidates is 443 (the default, unchanged), then the relay's own port number — the memorable
+ * choice, and it leaves 8443/10000 for services that need Funnel — then the remaining Funnel ports.
+ */
+function ensureServeOnly(bin, dns, state) {
+    const host = dns ?? '<node>';
+    if (state.port !== null) {
+        const url = serveUrl(host, state.port);
+        if (!state.funnelOn) {
+            console.info(`✓ tailscale serve fronts ${url} → 127.0.0.1:${RELAY_PORT} (tailnet-only)`);
+            return;
+        }
+        if (state.shared.length) {
+            leaveShared(url, state, 'tailnet-only');
+            return;
+        }
+        const failed = mountRelay(bin, 'serve', state.port);
+        if (failed) {
+            console.info(`\n  ⚠ could not take Funnel off ${url} (${failed}). Run by hand:\n      ${byHand('serve', state.port)}`);
+            return;
+        }
+        console.info(`✓ tailscale serve → ${url} is tailnet-only again → 127.0.0.1:${RELAY_PORT}`);
+        return;
+    }
+    const candidates = [443, Number(RELAY_PORT), ...FUNNEL_PORTS.filter(p => p !== 443)];
+    const port = freeServePort(state, candidates);
+    if (port === null) {
+        refuseNoPort(state, candidates);
+        return;
     }
+    if (port !== 443)
+        console.info(`  :443 carries ${describeTaken(state, 443)}, so the relay goes on :${port} instead.`);
+    const url = serveUrl(host, port);
+    const failed = mountRelay(bin, 'serve', port);
+    if (failed) {
+        console.info(`\n  ⚠ could not configure tailscale serve (${failed}). Run by hand:\n      ${byHand('serve', port)}`);
+        return;
+    }
+    console.info(`✓ tailscale serve → ${url} proxies 127.0.0.1:${RELAY_PORT} (tailnet-only)`);
 }
 /**
  * Persist a stable Tailscale device name so this node's MagicDNS URL — the origin the installed PWA is
@@ -351,39 +411,58 @@ function ensureTailscale() {
     const dns = magicDnsName(bin);
     if (dns)
         writeUrlHost(dns); // baseline for drift detection (server startup + `service status` compare against this)
-    const url = `https://${dns ?? '<node>'}/`;
+    const host = dns ?? '<node>';
     const mode = resolveExposeMode();
-    const state = tailscaleState(bin, dns);
+    const state = tailscaleState(bin);
     if (mode === 'tailnet') {
+        ensureServeOnly(bin, dns, state);
+        return;
+    }
+    // public (Funnel)
+    if (state.port !== null) {
+        const url = serveUrl(host, state.port);
         if (state.funnelOn) {
-            try {
-                execFileSync(bin, ['funnel', 'reset'], { stdio: 'pipe' });
-            }
-            catch {
-                // best-effort; ensureServeOnly re-asserts the proxy below
-            }
-            ensureServeOnly(bin, url, { proxyOk: false, funnelOn: false });
+            console.info(`✓ tailscale funnel already exposes ${url} → 127.0.0.1:${RELAY_PORT} (public, token-gated)`);
+            return;
         }
-        else {
-            ensureServeOnly(bin, url, state);
+        if (state.shared.length) {
+            leaveShared(url, state, 'public');
+            return;
+        }
+        if (!FUNNEL_PORTS.includes(state.port)) {
+            console.info(`\n  ⚠ the relay is fronted tailnet-only at ${url}, and Funnel cannot listen on :${state.port}`);
+            console.info(`    (only ${FUNNEL_PORTS.join(', ')}). Left as is — \`conductor-remote config\` will show the mismatch.`);
+            console.info(`    To go public, move it to a Funnel port by hand:  ${byHand('funnel', '<443|8443|10000>')}`);
+            return;
+        }
+        const failed = mountRelay(bin, 'funnel', state.port);
+        if (failed) {
+            funnelRefused(failed);
+            ensureServeOnly(bin, dns, state);
+            return;
         }
+        console.info(`✓ tailscale funnel → ${url} now public over the internet (token-gated) → 127.0.0.1:${RELAY_PORT}`);
         return;
     }
-    // public (Funnel)
-    if (state.proxyOk && state.funnelOn) {
-        console.info(`✓ tailscale funnel already exposes ${url} → 127.0.0.1:${RELAY_PORT} (public, token-gated)`);
+    const port = freeServePort(state, FUNNEL_PORTS);
+    if (port === null) {
+        refuseNoPort(state, FUNNEL_PORTS);
         return;
     }
-    try {
-        execFileSync(bin, ['funnel', '--bg', '--yes', RELAY_PORT], { stdio: 'pipe' });
-        console.info(`✓ tailscale funnel → ${url} now public over the internet (token-gated) → 127.0.0.1:${RELAY_PORT}`);
-    }
-    catch (err) {
-        console.info(`\n  ⚠ could not enable Funnel (${err instanceof Error ? err.message.trim() : err}).`);
-        console.info('    Funnel must be enabled for this tailnet: open the URL Tailscale printed above, or add the');
-        console.info('    "funnel" nodeAttr in Admin console ▸ Access controls. Falling back to tailnet-only for now.');
-        ensureServeOnly(bin, url, state);
+    if (port !== 443)
+        console.info(`  :443 carries ${describeTaken(state, 443)}, so the relay goes on :${port} instead.`);
+    const failed = mountRelay(bin, 'funnel', port);
+    if (failed) {
+        funnelRefused(failed);
+        ensureServeOnly(bin, dns, state);
+        return;
     }
+    console.info(`✓ tailscale funnel → ${serveUrl(host, port)} now public over the internet (token-gated) → 127.0.0.1:${RELAY_PORT}`);
+}
+function funnelRefused(error) {
+    console.info(`\n  ⚠ could not enable Funnel (${error}).`);
+    console.info('    Funnel must be enabled for this tailnet: open the URL Tailscale printed above, or add the');
+    console.info('    "funnel" nodeAttr in Admin console ▸ Access controls. Falling back to tailnet-only for now.');
 }
 /** Print a scannable QR of `url` (theme-independent black-on-white). Never fatal — QR is a convenience. */
 function printQr(url) {
@@ -404,10 +483,10 @@ function printUrl() {
             console.info(`\n${drift.join('\n')}`);
     }
     const dns = bin ? magicDnsName(bin) : null;
-    const state = bin ? tailscaleState(bin, dns) : { proxyOk: false, funnelOn: false };
-    if (dns && state.proxyOk) {
+    const state = bin ? tailscaleState(bin) : relayServeState({}, RELAY_PORT);
+    if (dns && state.port !== null) {
         const scope = state.funnelOn ? 'public — any browser, token-gated' : 'same Tailnet only';
-        const url = `https://${dns}/${frag}`;
+        const url = `${serveUrl(dns, state.port)}${frag}`;
         console.info(`\n  Phone URL (HTTPS, ${scope}):\n    ${url}`);
         if (token) {
             console.info('\n  Scan to open on your phone:');
@@ -417,7 +496,7 @@ function printUrl() {
     }
     // Nothing fronting yet — the relay is only on loopback.
     console.info(`\n  Local URL:\n    http://127.0.0.1:${RELAY_PORT}/${frag}`);
-    console.info(`\n  ⚠ Not reachable from your phone yet. Run \`tailscale funnel --bg ${RELAY_PORT}\` (public) or \`tailscale serve --bg ${RELAY_PORT}\` (tailnet)${dns ? ` → https://${dns}/` : ''}, then \`yarn service status\`.`);
+    console.info(`\n  ⚠ Not reachable from your phone yet. Run \`yarn deploy\` (it picks a free port), or by hand \`tailscale funnel --bg ${RELAY_PORT}\` (public) / \`tailscale serve --bg ${RELAY_PORT}\` (tailnet)${dns ? ` → https://${dns}/` : ''}, then \`yarn service status\`.`);
 }
 /** npx unpacks into a throwaway cache that gets purged; a LaunchAgent baked against it would rot. */
 function isEphemeralInstall(dir) {
@@ -607,6 +686,17 @@ function config() {
         // no token file yet
     }
     rows.push({ name: 'token', value: token, source: 'token file' });
+    // The HTTPS port is a live Tailscale fact, not a plist knob: :443 by default, elsewhere once another
+    // service holds :443 (see ensureServeOnly), and the phone URL carries whichever it is. Read against the
+    // daemon's own port, since this shell's RELAY_PORT is not the one the relay listens on.
+    const bin = tailscaleBin();
+    const livePort = env.RELAY_PORT ?? '8787';
+    const live = bin ? tailscaleState(bin, livePort) : relayServeState({}, livePort);
+    rows.push({
+        name: 'https-port',
+        value: live.port === null ? '(not fronted)' : String(live.port),
+        source: 'tailscale serve'
+    });
     const width = Math.max(...rows.map(r => r.name.length));
     const valueWidth = Math.max(...rows.map(r => r.value.length));
     console.info('');
@@ -618,25 +708,31 @@ function config() {
     // The cross-check worth having. A posture the relay believes and a Tailscale that is doing something
     // else is invisible in every other command, and it is self-healing in the wrong direction: the funnel
     // watchdog only runs for `public`, so a relay that thinks it is public will re-register Funnel.
-    const bin = tailscaleBin();
     const configured = rows.find(r => r.name === 'expose')?.value;
     if (!bin || !configured)
         return;
-    const dns = magicDnsName(bin);
-    const live = tailscaleState(bin, dns);
-    const liveMode = live.funnelOn ? 'public' : live.proxyOk ? 'tailnet' : null;
+    const liveMode = live.funnelOn ? 'public' : live.port !== null ? 'tailnet' : null;
+    const where = live.port !== null && live.port !== 443 ? ` on :${live.port}` : '';
+    const funnelable = live.port === null || FUNNEL_PORTS.includes(live.port);
     console.info('');
     if (liveMode === null) {
-        console.info(`  \u26a0 tailscale is not fronting 127.0.0.1:${RELAY_PORT} at all — the phone URL is not wired.`);
+        console.info(`  \u26a0 tailscale is not fronting 127.0.0.1:${livePort} at all — the phone URL is not wired.`);
         console.info('    Fix with: conductor-remote service install');
     }
     else if (liveMode === configured) {
-        console.info(`  \u2713 tailscale agrees: ${liveMode === 'public' ? 'Funnel on (internet-facing)' : 'serve only (tailnet)'}`);
+        console.info(`  \u2713 tailscale agrees: ${liveMode === 'public' ? 'Funnel on (internet-facing)' : 'serve only (tailnet)'}${where}`);
     }
     else {
-        console.info(`  \u26a0 tailscale says ${liveMode}, the daemon is configured ${configured}. They must match:`);
+        console.info(`  \u26a0 tailscale says ${liveMode}${where}, the daemon is configured ${configured}. They must match:`);
         console.info(`    the funnel watchdog only runs for \`public\`, so the two can heal each other apart.`);
-        console.info(`    Fix with: conductor-remote service install --expose ${configured}`);
+        if (configured === 'public' && !funnelable) {
+            console.info(`    Funnel cannot listen on :${live.port} (only ${FUNNEL_PORTS.join(', ')}), so either move the relay by hand`);
+            console.info(`    (tailscale funnel --bg --yes --https=<443|8443|10000> ${livePort}) or match the daemon to it:`);
+            console.info('    conductor-remote service install --expose tailnet');
+        }
+        else {
+            console.info(`    Fix with: conductor-remote service install --expose ${configured}`);
+        }
     }
 }
 function status() {

package/dist-node/src/funnel-watchdog.js CHANGED Viewed

@@ -29,7 +29,7 @@ import https from 'node:https';
 import net from 'node:net';
 import { promisify } from 'node:util';
 import { readSettings } from "./settings.js";
-import { magicDnsName, readExposeMode, relayPort, tailscaleBin } from "./tailscale.js";
+import { magicDnsName, parseServeStatus, readExposeMode, relayPort, relayServeState, tailscaleBin } from "./tailscale.js";
 import { hasDefaultRoute, joinNetwork, preferredNetworks } from "./wifi.js";
 import { joinInstantHotspot } from "./writes.js";
 const execFileP = promisify(execFile);
@@ -121,7 +121,33 @@ function tcpOpen(ip, port, timeoutMs) {
         socket.once('error', () => finish(false));
     });
 }
+/**
+ * The heal is `funnel reset` + `funnel --bg <port>`, which mounts the relay on :443. That is refused when
+ * :443 carries a mount that is not the relay's, or the relay is served on another port — the arrangement
+ * once another service needs :443 (OpenAI's cloud dials nothing else, measured 2026-09-02, so the voice
+ * listener holds :443 and the relay sits tailnet-only on :8787). The probe above was never reaching the
+ * relay in that case, and the heal would delete the mount it did reach. Fails closed: a status that cannot
+ * be read blocks the heal, never allows it.
+ */
+async function reRegisterBlocked(bin, port) {
+    try {
+        const { stdout } = await execFileP(bin, ['serve', 'status', '--json'], { encoding: 'utf8', timeout: 10_000 });
+        const state = relayServeState(parseServeStatus(stdout), port);
+        const foreign = state.taken.get(443);
+        if (foreign?.length)
+            return `:443 carries ${foreign.join(', ')}`;
+        if (state.port !== null && state.port !== 443)
+            return `the relay is served on :${state.port}, not :443`;
+        return null;
+    }
+    catch (err) {
+        return `could not read tailscale serve status (${err instanceof Error ? err.message.trim() : String(err)})`;
+    }
+}
 async function reRegisterFunnel(bin, port) {
+    const blocked = await reRegisterBlocked(bin, port);
+    if (blocked)
+        throw new Error(`not re-registering, ${blocked}`);
     await execFileP(bin, ['funnel', 'reset'], { timeout: 15_000 });
     await execFileP(bin, ['funnel', '--bg', '--yes', port], { timeout: 20_000 });
 }
@@ -156,6 +182,7 @@ let fails = 0;
 let dnsFails = 0;
 let lastHealAt = 0;
 let lastRejoinAt = 0;
+let blockedLogged = null;
 const REJOIN_COOLDOWN_MS = 5 * 60 * 1000; // a network switch is disruptive; never churn on one
 const REJOIN_SETTLE_MS = 12 * 1000; // DHCP + tailscaled noticing the new endpoint
 // An Instant Hotspot press has the phone's Bluetooth wake + hotspot spin-up in front of the
@@ -289,6 +316,15 @@ async function tick(host, bin, port, intervalMs) {
     }
     if (Date.now() - lastHealAt < HEAL_COOLDOWN_MS)
         return again(intervalMs);
+    // A block is a standing fact, so it is logged when it changes and not once a minute for as long as it holds.
+    const blocked = await reRegisterBlocked(bin, port);
+    if (blocked) {
+        if (blocked !== blockedLogged)
+            log(`ingress probe failing (${fails}), but not re-registering: ${blocked}`);
+        blockedLogged = blocked;
+        return again(intervalMs);
+    }
+    blockedLogged = null;
     log(`funnel ingress stale (${fails} failed probes, ingress TCP-reachable) — re-registering: funnel reset && funnel --bg ${port}`);
     try {
         await reRegisterFunnel(bin, port);

package/dist-node/src/tailscale.js CHANGED Viewed

@@ -122,3 +122,72 @@ export function driftWarningLines(bin) {
         `    …or re-add the PWA at the new URL:  https://${drift.current}/`
     ];
 }
+/** Tailscale's Funnel listens on these ports only; a tailnet-only `serve` may use any port. */
+export const FUNNEL_PORTS = [443, 8443, 10000];
+/** `tailscale serve status --json` prints `null` for an empty config, and anything else is not a status. */
+export function parseServeStatus(out) {
+    try {
+        const parsed = JSON.parse(out);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function portOf(hostPort) {
+    const port = Number(hostPort.slice(hostPort.lastIndexOf(':') + 1));
+    return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
+}
+function describeHandler(handler) {
+    return handler.Proxy ?? handler.Path ?? (handler.Text !== undefined ? 'text' : 'unknown');
+}
+/** Pure: reads one parsed status, so a saved JSON can drive it in a test. `relayPort` is the loopback port. */
+export function relayServeState(status, relayPort) {
+    const relayTargets = new Set([`http://127.0.0.1:${relayPort}`, `http://localhost:${relayPort}`]);
+    const owned = new Map(); // port → the host:port key, for the AllowFunnel lookup
+    const taken = new Map();
+    const claim = (port, what) => {
+        const list = taken.get(port) ?? [];
+        list.push(what);
+        taken.set(port, list);
+    };
+    for (const [key, web] of Object.entries(status.Web ?? {})) {
+        const port = portOf(key);
+        if (port === null)
+            continue;
+        for (const [mount, handler] of Object.entries(web.Handlers ?? {})) {
+            const relay = handler.Proxy !== undefined && relayTargets.has(handler.Proxy);
+            if (relay && mount === '/') {
+                if (!owned.has(port) || port === 443)
+                    owned.set(port, key);
+                continue;
+            }
+            // A relay mount off the root is not a phone URL, and not a stranger either: neither owned nor taken.
+            if (!relay)
+                claim(port, `${mount} → ${describeHandler(handler)}`);
+        }
+    }
+    for (const [key, tcp] of Object.entries(status.TCP ?? {})) {
+        const port = portOf(key);
+        if (port === null)
+            continue;
+        if (tcp.TCPForward)
+            claim(port, `tcp → ${tcp.TCPForward}`);
+    }
+    const port = owned.has(443) ? 443 : ([...owned.keys()].sort((a, b) => a - b)[0] ?? null);
+    const key = port === null ? undefined : owned.get(port);
+    return {
+        port,
+        funnelOn: key !== undefined && status.AllowFunnel?.[key] === true,
+        shared: port === null ? [] : (taken.get(port) ?? []),
+        taken
+    };
+}
+/** The first candidate port carrying nothing the relay does not own, or null when every one is spoken for. */
+export function freeServePort(state, candidates) {
+    return candidates.find(port => !state.taken.has(port)) ?? null;
+}
+/** The phone URL for a node name and the HTTPS port fronting the relay — no port suffix on 443. */
+export function serveUrl(host, port) {
+    return `https://${host}${port === 443 ? '' : `:${port}`}/`;
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.76.0",
+	"version": "1.76.1",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",