create-walle 0.10.1 → 0.10.3

package/template/coding-task-manager/lib/api/setup-network.js

@@ -2,19 +2,27 @@
 
 // Round-3 WP-5 T3 group 4 (design doc §5 D-1/D-3/D-8, §8 WP-5, §9.5 S-42):
 // group 3 (lib/api/worktrees.js) deliberately skipped this cluster because
-// server.js's legacy chain gates entry to handleSetupNetwork with a single
-// big OR condition and then does `if (await handleSetupNetwork(...) !== false)
+// server.js's legacy chain gated entry to handleSetupNetwork with a single
+// big OR condition and then did `if (await handleSetupNetwork(...) !== false)
 // return;` — a matched-but-declined dispatch that lib/api-router.js couldn't
 // express (a matched route was always "handled"). lib/api-router.js's
-// ROUTE_DECLINED sentinel (added in this same work package) closes that gap:
-// this module registers the same ten path specs the legacy OR-gate used to
-// gate on, each wrapping a call to handleSetupNetwork and returning
-// ROUTE_DECLINED exactly where the legacy `!== false` check would have let
-// the (now-deleted) chain entry fall through. handleSetupNetwork itself is
-// NOT moved — it stays a top-level `async function` in server.js (unchanged
-// body, closes over the same transport/tailscale/golive state as before) and
-// is injected via configure(), same as every other name in this file's
-// sibling modules.
+// ROUTE_DECLINED sentinel closes that gap: this module registers the same ten
+// path specs the legacy OR-gate used to gate on, each wrapping a call to
+// handleSetupNetwork and returning ROUTE_DECLINED exactly where the legacy
+// `!== false` check would have let the (now-deleted) chain entry fall through.
+//
+// Landing-throughput WP-5 shard S2 (design doc §5 D-10 "move-only", §6 "Shard
+// module seam", §8 WP-5, §9 S-21..S-27): handleSetupNetwork itself now moves
+// out of server.js VERBATIM — it was the last dispatch-only name this file
+// injected. Its body is identical to server.js's declaration except for the
+// `_deps.` prefix on every identifier that used to resolve to a server.js
+// top-level binding (D-10 rule 1), proven by `node bin/move-only-check.js`.
+// Injected deps (40): CONFIG_DIR, CTM_SESSION_STREAM_SLICE, PORT, _applyTransportEnvValues, _cacheGolivePlan, _connectionHealthForPairing, _goliveManifestRefreshLease, _golivePeersSummaryCache, _golivePlan, _golivePlanCache, _invalidateGoliveProbes, _mergeAllowedOriginTransportEnv, _mergeCloudflareTransportEnv, _noteMicrosoftTunnelOrigin, _readSetupJsonBody, _runMicrosoftTunnelRecovery, _scheduleTransportRestart, _tailscaleCertificateSupervisor, _transportEnvValuesFromInput, _transportNetworkStatus, applyCloudflareFallbackSetup, applyMicrosoftDevTunnelSetup, checkMicrosoftDevTunnelLoginStatus, clearMicrosoftDevTunnelTraffic, detectMicrosoftDevTunnelSetup, detectTailscaleSetup, generateTailscaleCert, getMicrosoftDevTunnelProgress, isLocalOrTailnetRequest, loadManagedTunnelState, logoutMicrosoftDevTunnelUser, managedTunnelDesiredRunning, probeMicrosoftDevTunnelPublicAccess, redactGolivePlanSteps, resetMicrosoftDevTunnelPrivateAccess, setMicrosoftDevTunnelKeepAwake, startMicrosoftDevTunnelInstall, startMicrosoftDevTunnelLogin, stopMicrosoftDevTunnel, tailscaleCertificateLifecycle.
+// _golivePlanCache/_golivePeersSummaryCache are the only mutable ones (declared
+// `let` and reassigned later in server.js by _cacheGolivePlan /
+// _refreshGolivePeersSummaryCache), so they are injected as GETTERS — a copied
+// value would freeze at configure() time (D-10 rule 2). Everything else is an
+// immutable `const`/function declaration and is passed by value.
 //
 // None of these ten path specs carry a method filter here — the legacy
 // OR-gate didn't filter by method either (method enforcement happens INSIDE
@@ -25,14 +33,534 @@ const { registerApiRoutes, ROUTE_DECLINED } = require('../api-router');
 
 let _deps = null;
 
-function configure({ handleSetupNetwork } = {}) {
-  _deps = { handleSetupNetwork };
+// deps (40), per D-10 rule 1: CONFIG_DIR, CTM_SESSION_STREAM_SLICE, PORT, _applyTransportEnvValues, _cacheGolivePlan, _connectionHealthForPairing, _goliveManifestRefreshLease, _golivePeersSummaryCache, _golivePlan, _golivePlanCache, _invalidateGoliveProbes, _mergeAllowedOriginTransportEnv, _mergeCloudflareTransportEnv, _noteMicrosoftTunnelOrigin, _readSetupJsonBody, _runMicrosoftTunnelRecovery, _scheduleTransportRestart, _tailscaleCertificateSupervisor, _transportEnvValuesFromInput, _transportNetworkStatus, applyCloudflareFallbackSetup, applyMicrosoftDevTunnelSetup, checkMicrosoftDevTunnelLoginStatus, clearMicrosoftDevTunnelTraffic, detectMicrosoftDevTunnelSetup, detectTailscaleSetup, generateTailscaleCert, getMicrosoftDevTunnelProgress, isLocalOrTailnetRequest, loadManagedTunnelState, logoutMicrosoftDevTunnelUser, managedTunnelDesiredRunning, probeMicrosoftDevTunnelPublicAccess, redactGolivePlanSteps, resetMicrosoftDevTunnelPrivateAccess, setMicrosoftDevTunnelKeepAwake, startMicrosoftDevTunnelInstall, startMicrosoftDevTunnelLogin, stopMicrosoftDevTunnel, tailscaleCertificateLifecycle.
+// The object is stored BY REFERENCE (never destructured) so the two live getters server.js
+// passes — `get _golivePlanCache()` / `get _golivePeersSummaryCache()` (D-10 rule 2: both are
+// `let` in server.js and reassigned by _cacheGolivePlan / _refreshGolivePeersSummaryCache) —
+// are read at each call instead of frozen at configure() time.
+function configure(deps = {}) {
+  _deps = deps;
 }
-
 async function _dispatch(req, res, url) {
-  const result = await _deps.handleSetupNetwork(req, res, url);
+  const result = await handleSetupNetwork(req, res, url);
   return result === false ? ROUTE_DECLINED : result;
 }
+async function handleSetupNetwork(req, res, url) {
+  if (url.pathname === '/api/setup/network' && req.method === 'GET') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(await _deps._transportNetworkStatus(req)));
+    return true;
+  }
+  // Cheap, pollable unified health for the three phone-access methods (read-only).
+  // D-7: routes through _connectionHealthForPairing — the ONE builder both this endpoint and
+  // /api/phone/health consume — so tunnel_egress (the Dev Tunnels bandwidth ledger truth)
+  // is attached in a single place for both.
+  if (url.pathname === '/api/setup/connection-health' && req.method === 'GET') {
+    let payload;
+    try {
+      payload = await _deps._connectionHealthForPairing();
+    } catch (err) {
+      payload = { ok: false, error: String((err && err.message) || err) };
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+    return true;
+  }
+  if (url.pathname === '/api/setup/network/tailscale-certificate' && req.method === 'GET') {
+    try {
+      const tailscaleSetup = await _deps.detectTailscaleSetup({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      const certificate = await _deps.tailscaleCertificateLifecycle.inspectTailscaleCertificate({
+        configDir: _deps.CONFIG_DIR,
+        setup: tailscaleSetup,
+      });
+      const recovery = await _deps.tailscaleCertificateLifecycle.loadTailscaleCertificateState({ configDir: _deps.CONFIG_DIR });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, tailscale: tailscaleSetup, certificate, recovery }));
+      return true;
+    } catch (e) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/tailscale-certificate/recover' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 2048);
+      const result = await _deps._tailscaleCertificateSupervisor.check('manual', { force: data.force === true });
+      res.writeHead(result.ok ? 200 : 409, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/start' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 4096);
+      const setupResult = await _deps.applyMicrosoftDevTunnelSetup(data, {
+        configDir: _deps.CONFIG_DIR,
+        port: _deps.PORT,
+      });
+      if (!setupResult.ok) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          error: setupResult.error || 'Microsoft tunnel setup failed.',
+          code: setupResult.error_code || 'microsoft_tunnel_setup_failed',
+          microsoft_dev_tunnel: setupResult.setup || null,
+        }));
+        return true;
+      }
+
+      const envValues = _deps._mergeAllowedOriginTransportEnv(setupResult.origin);
+      _deps._applyTransportEnvValues(envValues);
+      await _deps._noteMicrosoftTunnelOrigin(setupResult.origin, 'start');
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        restart_scheduled: false,
+        restart_required: false,
+        values: {
+          allowed_origins: envValues.CTM_ALLOWED_ORIGINS ? envValues.CTM_ALLOWED_ORIGINS.split(',') : [],
+          mobile_url: setupResult.mobile_url,
+          origin: setupResult.origin,
+          inspect_url: setupResult.inspect_url,
+          tunnel_id: setupResult.tunnel_id,
+          managed_tunnel: setupResult.managed_tunnel,
+        },
+        microsoft_dev_tunnel: {
+          tunnel_id: setupResult.tunnel_id,
+          origin: setupResult.origin,
+          mobile_url: setupResult.mobile_url,
+          inspect_url: setupResult.inspect_url,
+          managed_tunnel: setupResult.managed_tunnel,
+          traffic: setupResult.traffic,
+        },
+      }));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/install' && req.method === 'POST') {
+    try {
+      const result = await _deps.startMicrosoftDevTunnelInstall({
+        configDir: _deps.CONFIG_DIR,
+        port: _deps.PORT,
+      });
+      const status = result.ok ? 200 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: !!result.ok,
+        already_installed: !!result.already_installed,
+        install: result.install || null,
+        error: result.error || '',
+        code: result.error_code || '',
+        microsoft_dev_tunnel: result.setup || null,
+        progress: result.progress || _deps.getMicrosoftDevTunnelProgress({ configDir: _deps.CONFIG_DIR, port: _deps.PORT }),
+      }));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/progress' && req.method === 'GET') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+      ok: true,
+      progress: _deps.getMicrosoftDevTunnelProgress({ configDir: _deps.CONFIG_DIR, port: _deps.PORT }),
+    }));
+    return true;
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/probe' && req.method === 'GET') {
+    try {
+      const setup = await _deps.detectMicrosoftDevTunnelSetup({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      const probe = await _deps.probeMicrosoftDevTunnelPublicAccess(setup, {
+        timeoutMs: 6000,
+      });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: !!probe.checked,
+        probe,
+        microsoft_dev_tunnel: {
+          ...setup,
+          public_probe: probe,
+        },
+      }));
+      return true;
+    } catch (e) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: false,
+        probe: {
+          ok: false,
+          checked: true,
+          diagnosis: 'probe_failed',
+          message: e.message || 'Microsoft tunnel URL check failed.',
+        },
+      }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/recover' && req.method === 'POST') {
+    try {
+      const result = await _deps._runMicrosoftTunnelRecovery('manual');
+      const status = result.ok ? 200 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/reset-private' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 2048);
+      const result = await _deps.resetMicrosoftDevTunnelPrivateAccess(data, {
+        configDir: _deps.CONFIG_DIR,
+        port: _deps.PORT,
+      });
+      const status = result.ok ? 200 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: !!result.ok,
+        access: result.access || null,
+        managed_tunnel: result.managed_tunnel || null,
+        microsoft_dev_tunnel: result.setup || null,
+        error: result.error || '',
+        code: result.error_code || '',
+      }));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/keep-awake' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 2048);
+      const result = await _deps.setMicrosoftDevTunnelKeepAwake(data.enabled === true, {
+        configDir: _deps.CONFIG_DIR,
+        port: _deps.PORT,
+      });
+      const status = result.ok ? 200 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/login' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 2048);
+      const result = _deps.startMicrosoftDevTunnelLogin(data, { configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/login/check' && req.method === 'POST') {
+    try {
+      const result = await _deps.checkMicrosoftDevTunnelLoginStatus({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      // Sign-in is back: bring the tunnel + access rules back without further
+      // clicks (don't block the response on it).
+      if (result.signed_in && _deps.managedTunnelDesiredRunning(_deps.loadManagedTunnelState({ configDir: _deps.CONFIG_DIR }) || {})) {
+        _deps._runMicrosoftTunnelRecovery('login-restored').catch(() => {});
+      }
+      const status = result.ok ? 200 : 409;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/logout' && req.method === 'POST') {
+    try {
+      const result = await _deps.logoutMicrosoftDevTunnelUser({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      const status = result.ok ? 200 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/stop' && req.method === 'POST') {
+    const result = await _deps.stopMicrosoftDevTunnel({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+    return true;
+  }
+  if (url.pathname === '/api/setup/network/microsoft-dev-tunnel/traffic/clear' && req.method === 'POST') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, traffic: _deps.clearMicrosoftDevTunnelTraffic() }));
+    return true;
+  }
+  if (url.pathname === '/api/setup/network/tailscale-auto' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 4096);
+      const setupInfo = await _deps.detectTailscaleSetup({ configDir: _deps.CONFIG_DIR, port: _deps.PORT });
+      if (!setupInfo.available) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: setupInfo.error || 'Tailscale setup is not available.', code: setupInfo.error_code || 'tailscale_unavailable', tailscale: setupInfo }));
+        return true;
+      }
+
+      const shouldGenerateCert = data.generate_cert !== false && data.generateCert !== false;
+      if (shouldGenerateCert) {
+        const certResult = await _deps.generateTailscaleCert(setupInfo);
+        if (!certResult.ok) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: certResult.error || 'Could not generate Tailscale certificate.', code: certResult.error_code || 'tailscale_cert_failed', tailscale: setupInfo }));
+          return true;
+        }
+        setupInfo.cert_exists = true;
+        setupInfo.key_exists = true;
+      } else if (!setupInfo.cert_exists || !setupInfo.key_exists) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Tailscale certificate files do not exist yet.', code: 'tailscale_cert_missing', tailscale: setupInfo }));
+        return true;
+      }
+
+      const decision = _deps._transportEnvValuesFromInput({
+        host: setupInfo.host,
+        tls_cert: setupInfo.cert_path,
+        tls_key: setupInfo.key_path,
+        allowed_origins: setupInfo.origin,
+        cloudflare_access: data.cloudflare_access || data.cloudflareAccess || null,
+      });
+      if (!decision.ok) {
+        res.writeHead(decision.status || 400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: decision.error, code: decision.code }));
+        return true;
+      }
+      _deps._applyTransportEnvValues(decision.envValues);
+
+      const shouldRestart = data.restart !== false;
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        restart_scheduled: shouldRestart,
+        restart_required: true,
+        values: {
+          host: setupInfo.host,
+          tls_cert: setupInfo.cert_path,
+          tls_key: setupInfo.key_path,
+          allowed_origins: [setupInfo.origin],
+          mobile_url: setupInfo.mobile_url,
+        },
+        tailscale: setupInfo,
+      }));
+      if (shouldRestart) _deps._scheduleTransportRestart();
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return true;
+    }
+  }
+  if (url.pathname === '/api/setup/network/cloudflare-auto' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 8192);
+      const setupResult = await _deps.applyCloudflareFallbackSetup(data, {
+        configDir: _deps.CONFIG_DIR,
+        port: _deps.PORT,
+      });
+      if (!setupResult.ok) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          error: setupResult.error || 'Cloudflare fallback setup failed.',
+          code: setupResult.error_code || 'cloudflare_setup_failed',
+          cloudflare: setupResult.setup || null,
+          cloudflared: setupResult.cloudflared || null,
+        }));
+        return true;
+      }
+
+      const envValues = _deps._mergeCloudflareTransportEnv(setupResult.env, setupResult.origin);
+      _deps._applyTransportEnvValues(envValues);
+      const shouldRestart = data.restart === true;
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        restart_scheduled: shouldRestart,
+        restart_required: shouldRestart,
+        values: {
+          hostnames: [setupResult.hostname],
+          allowed_origins: envValues.CTM_ALLOWED_ORIGINS ? envValues.CTM_ALLOWED_ORIGINS.split(',') : [],
+          mobile_url: setupResult.mobile_url,
+          config_path: setupResult.config_path,
+          config_written: !!setupResult.config_written,
+          remote_config: !!setupResult.remote_config,
+          token_file_written: !!setupResult.token_file_written,
+          run_command: (setupResult.config_written || setupResult.token_file_written || setupResult.managed_tunnel?.running) ? setupResult.commands.run.display : '',
+          route_dns_command: setupResult.commands.route_dns.display,
+          tunnel_running: !!setupResult.managed_tunnel?.running,
+          managed_tunnel: setupResult.managed_tunnel,
+          access: setupResult.access,
+          provisioned_access: setupResult.provisioned_access,
+          provisioned_tunnel: setupResult.provisioned_tunnel,
+          cloudflare_context: setupResult.cloudflare_context,
+        },
+        cloudflare: {
+          hostname: setupResult.hostname,
+          origin: setupResult.origin,
+          mobile_url: setupResult.mobile_url,
+          local_service: setupResult.local_service,
+          tunnel_name: setupResult.tunnel_name,
+          tunnel_id: setupResult.tunnel_id,
+          remote_config: !!setupResult.remote_config,
+          config_path: setupResult.config_path,
+          config_written: !!setupResult.config_written,
+          token_file_written: !!setupResult.token_file_written,
+          managed_tunnel: setupResult.managed_tunnel,
+          commands: setupResult.commands,
+          access: setupResult.access,
+          provisioned_access: setupResult.provisioned_access,
+          provisioned_tunnel: setupResult.provisioned_tunnel,
+          cloudflare_context: setupResult.cloudflare_context,
+        },
+      }));
+      if (shouldRestart) _deps._scheduleTransportRestart();
+      return true;
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return true;
+    }
+  }
+  // --- Go-Live Wizard (GW-3) ---------------------------------------------
+  if (url.pathname === '/api/setup/golive' && req.method === 'GET') {
+    try {
+      let plan;
+      if (!_deps.CTM_SESSION_STREAM_SLICE) {
+        // Rollback lane: preserve the parent request-path verification.
+        plan = await _deps._golivePlan.getPlan();
+      } else if (_deps._golivePlanCache) {
+        _deps._goliveManifestRefreshLease.touch();
+        plan = _deps._golivePlanCache;
+      } else {
+        // The first ever request has no last-known value to serve. Populate it once; later
+        // visibility/use resumptions serve this snapshot and refresh asynchronously.
+        _deps._goliveManifestRefreshLease.touch({ refresh: false });
+        plan = await _deps._golivePlan.getPlan();
+        _deps._cacheGolivePlan(plan);
+      }
+      const auth = req.ctmAuth || {};
+      const revealSecrets = _deps.isLocalOrTailnetRequest(req) || !!auth.stepUpFresh;
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        steps: _deps.redactGolivePlanSteps(plan.steps, { revealSecrets }),
+        active_step: plan.active_step,
+        // GW-6: read-only peer go-live visibility, served from a cached,
+        // best-effort snapshot (see _refreshGolivePeersSummaryCache) — never
+        // fetched live on this request path.
+        peers: _deps._golivePeersSummaryCache,
+      }));
+    } catch (e) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+    }
+    return true;
+  }
+  if (url.pathname === '/api/setup/golive/step' && req.method === 'POST') {
+    try {
+      // An explicit wizard action: the user is asking for the CURRENT truth, and the step it runs
+      // may itself change tunnel state. Never answer this one from the passive probe memo.
+      _deps._invalidateGoliveProbes();
+      const data = await _deps._readSetupJsonBody(req, 4096);
+      const id = String(data.id || '').trim();
+      if (!id) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'id_required' }));
+        return true;
+      }
+      const step = await _deps._golivePlan.runStep(id, data.input || {});
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, step }));
+    } catch (e) {
+      const status = e && e.code === 'unknown_step' ? 404 : (e && e.code === 'step_already_running' ? 409 : 400);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message, code: e && e.code }));
+    }
+    return true;
+  }
+  if (url.pathname === '/api/setup/golive/skip' && req.method === 'POST') {
+    try {
+      const data = await _deps._readSetupJsonBody(req, 4096);
+      const id = String(data.id || '').trim();
+      if (!id) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'id_required' }));
+        return true;
+      }
+      const plan = await _deps._golivePlan.skipStep(id, data.reason || '');
+      _deps._cacheGolivePlan(plan);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, steps: plan.steps, active_step: plan.active_step }));
+    } catch (e) {
+      const status = e && e.code === 'unknown_step' ? 404 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message, code: e && e.code }));
+    }
+    return true;
+  }
+  if (url.pathname === '/api/setup/golive/reset' && req.method === 'POST') {
+    try {
+      _deps._invalidateGoliveProbes();
+      const plan = await _deps._golivePlan.reset();
+      _deps._cacheGolivePlan(plan);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, steps: plan.steps, active_step: plan.active_step }));
+    } catch (e) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+    }
+    return true;
+  }
+
+  if (req.method !== 'POST') return false;
+  try {
+    const data = await _deps._readSetupJsonBody(req);
+    const decision = _deps._transportEnvValuesFromInput(data);
+    if (!decision.ok) {
+      res.writeHead(decision.status || 400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: decision.error, code: decision.code }));
+      return true;
+    }
+    _deps._applyTransportEnvValues(decision.envValues);
+
+    const shouldRestart = data.restart !== false;
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, restart_scheduled: shouldRestart, restart_required: true }));
+    if (shouldRestart) _deps._scheduleTransportRestart();
+  } catch (e) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: e.message }));
+  }
+  return true;
+}
 
 function register() {
   registerApiRoutes('setup-network', [
@@ -49,4 +577,4 @@ function register() {
   ]);
 }
 
-module.exports = { configure, register };
+module.exports = { configure, register, handleSetupNetwork };