harnery 0.42.0 → 0.43.0

package/dist/commands/tunnel.js

@@ -4,8 +4,11 @@ import { resolve } from "node:path";
 import { resolveCoordRoot } from "../core/agents/coord-client.js";
 import { resolveBinName } from "../core/config.js";
 import { tryRegisterServer, tunnelServerId, tunnelServerInput, unregisterServer, } from "../core/servers/index.js";
-import { processLogDestination, runRotatingProcessSync, spawnRotatingProcess, } from "../core/storage/process-log.js";
+import { processLogDestination, runProcessLogWorker, runRotatingProcessSync, spawnRotatingProcess, } from "../core/storage/process-log.js";
+import { normalizeAllowEntry } from "../lib/tunnel/allowlist.js";
+import { detectPublicAddresses, planCurrentAddresses, } from "../lib/tunnel/current-address.js";
 import { ALLOW_PATHS_ENV, normalizeAllowPaths } from "../lib/tunnel/path-scope.js";
+import { connectProbe, findPidsByCommandLine, listeningPorts, portListening, } from "../lib/tunnel/processes.js";
 import { clearState, DEFAULT_INSTANCE, ensureCloudflared, gateLogFile, isProcessAlive, isTunnelStateLive, listStates, providerLogFile, readConfig, readState, writeConfig, writeState, } from "../lib/tunnel/state.js";
 /**
  * `tunnel`: provider-backed tunnel in front of a local upstream.
@@ -17,9 +20,11 @@ import { clearState, DEFAULT_INSTANCE, ensureCloudflared, gateLogFile, isProcess
  * Every provider also passes through a path scope: `up` requires at least one
  * `--allow-path <prefix>`, and the gate refuses any request outside it.
  *
- * State + config persisted under `.cache/tunnel/`. cloudflared auto-installs
- * to ~/.local/bin/ on first run (Linux only; macOS users `brew install`);
- * Tailscale requires an installed/authenticated `tailscale` CLI.
+ * State + config persisted under `.cache/tunnel/` (or `$HARNERY_TUNNEL_DIR`).
+ * cloudflared comes from `$HARNERY_CLOUDFLARED` / the config's `cloudflared_path`
+ * when set, else PATH, else auto-installs to ~/.local/bin/ on Linux (macOS and
+ * Windows hosts install it themselves); Tailscale requires an installed and
+ * authenticated `tailscale` CLI.
  */
 const DEFAULT_TARGET = "127.0.0.1:8001";
 const DEFAULT_VHOST = "localhost";
@@ -142,35 +147,87 @@ function collectPath(value, previous) {
 function gateScriptPath() {
     return resolve(import.meta.dirname, "..", "lib", "tunnel", "gate.ts");
 }
+/** The gate worker's `--name`/`--port` marker, also what the stray sweep matches. */
+const GATE_SUBCOMMAND = ["tunnel", "gate"];
 /**
- * `harn tunnel` is the one command that hard-requires Bun: the gate worker is a
- * `Bun.serve` process (HTTP + WebSocket reverse proxy), spawned as `bun run
- * gate.ts`. Everything else in harnery runs on Node, but this can't until the
- * gate is ported off `Bun.serve` (node:http + `ws`). Detect Bun up front so the
- * failure is a clear message rather than an opaque ENOENT from the gate spawn.
+ * How to start the gate worker, which is a `Bun.serve` process (HTTP and
+ * WebSocket reverse proxy):
+ *   1. From a source or package checkout, `gate.ts` sits beside this module and
+ *      runs directly.
+ *   2. Inside a single-file bundle there is no such file. The CLI then
+ *      re-executes itself with the hidden `tunnel gate` task, which loads the
+ *      gate in-process. This uses the running Bun binary, so Bun need not be
+ *      on PATH.
+ * Null means neither works (a Node host with no Bun, or an unknown entry).
  */
-function bunAvailable() {
-    return spawnSync("bun", ["--version"], { stdio: "ignore" }).status === 0;
+export function resolveGateLaunch(i) {
+    if (i.gateScriptExists && (i.underBun || i.bunOnPath)) {
+        return {
+            command: i.underBun ? i.execPath : "bun",
+            arguments: ["run", i.gateScript],
+        };
+    }
+    if (i.underBun && i.entryScript && i.entryScriptExists) {
+        return { command: i.execPath, arguments: [i.entryScript, ...GATE_SUBCOMMAND] };
+    }
+    return null;
+}
+/**
+ * How to start the log wrapper that rotates each process's output. Beside a
+ * source or package checkout the default (this package's own wrapper file)
+ * works; inside a single-file bundle the CLI re-executes itself with the hidden
+ * `tunnel log-worker` task instead.
+ */
+export function resolveWorkerLaunch(i) {
+    if (i.gateScriptExists)
+        return undefined;
+    if (i.underBun && i.entryScript && i.entryScriptExists) {
+        return { command: i.execPath, arguments: [i.entryScript, "tunnel", "log-worker"] };
+    }
+    return undefined;
 }
+function currentLaunchInputs() {
+    const gateScript = gateScriptPath();
+    const entryScript = process.argv[1] ? resolve(process.argv[1]) : undefined;
+    const underBun = typeof process.versions.bun === "string";
+    const gateScriptExists = existsSync(gateScript);
+    return {
+        gateScript,
+        gateScriptExists,
+        underBun,
+        execPath: process.execPath,
+        entryScript,
+        entryScriptExists: entryScript ? existsSync(entryScript) : false,
+        bunOnPath: !underBun && gateScriptExists && bunOnPath(),
+    };
+}
+function currentGateLaunch() {
+    return resolveGateLaunch(currentLaunchInputs());
+}
+function currentWorkerLaunch() {
+    return resolveWorkerLaunch(currentLaunchInputs());
+}
+function bunOnPath() {
+    return spawnSync("bun", ["--version"], { stdio: "ignore", windowsHide: true }).status === 0;
+}
+const requiresBunMessage = () => `${resolveBinName()} tunnel requires Bun: the gate worker is a Bun.serve process. ` +
+    "Install Bun (https://bun.sh) and re-run. (Every other command runs on Node.)";
 function tailscaleAvailable() {
-    return spawnSync("tailscale", ["version"], { stdio: "ignore" }).status === 0;
+    return spawnSync("tailscale", ["version"], { stdio: "ignore", windowsHide: true }).status === 0;
 }
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
 /**
- * Kill every process whose command line matches `pattern` (via `pgrep -f`),
- * skipping our own PID and any already-killed. Returns the count killed. Used
- * as a fallback so orphaned gate/cloudflared processes get cleaned even when
- * the state file was lost (which otherwise left them squatting on the port).
+ * Kill every process whose command line matches `pattern` (an extended regular
+ * expression), skipping our own PID and any already-killed. Returns the count
+ * killed. Used as a fallback so orphaned gate/cloudflared processes get cleaned
+ * even when the state file was lost (which otherwise left them squatting on the
+ * port).
  */
 function killByPattern(pattern, alreadyKilled) {
-    const r = spawnSync("pgrep", ["-f", pattern], { encoding: "utf-8" });
-    if (r.status !== 0 || typeof r.stdout !== "string")
-        return 0;
     let killed = 0;
-    for (const line of r.stdout.split("\n")) {
-        const pid = Number(line.trim());
+    for (const pid of findPidsByCommandLine(pattern)) {
         if (!pid || pid === process.pid || alreadyKilled.has(pid))
             continue;
         try {
@@ -184,58 +241,41 @@ function killByPattern(pattern, alreadyKilled) {
     }
     return killed;
 }
+/**
+ * Command-line pattern for ONE instance's gate, identified by its port. Matches
+ * both launch forms: `bun run .../gate.ts --name N --port P` and a host CLI
+ * re-executing itself as `<cli> tunnel gate --name N --port P`. Port boundary is
+ * guarded with `( |$)` so port 9001 doesn't match 90011.
+ */
+function gatePattern(gatePort) {
+    return `(gate\\.ts|tunnel gate) .*--port ${gatePort}( |$)`;
+}
 /**
  * Sweep stray gate + cloudflared processes for ONE instance, identified by its
  * gate port. Both signatures are port-scoped so tearing down one tunnel never
  * touches another:
- *   - gate:        `gate.ts ... --port <port>` (the port is on the gate's argv)
+ *   - gate:        see gatePattern (the port is on the gate's argv)
  *   - cloudflared: `--url http://localhost:<port>` (order-independent, so it
  *     matches regardless of the `--protocol http2` flag we also pass).
- * Port boundary is guarded with `( |$)` so port 9001 doesn't match 90011.
  */
 function sweepStrays(gatePort, alreadyKilled) {
-    return (killByPattern(`gate\\.ts.*--port ${gatePort}( |$)`, alreadyKilled) +
+    return (killByPattern(gatePattern(gatePort), alreadyKilled) +
         killByPattern(`--url http://localhost:${gatePort}( |$)`, alreadyKilled));
 }
-/**
- * Ports currently bound by a LISTEN socket (best-effort, platform-dependent).
- *
- * `ss` (iproute2) is Linux-only. Without the lsof fallback this returns an empty
- * set on macOS/BSD. That does not fail loudly. It reports every port as free, so
- * `allocateGatePort` can hand out an occupied port and the reload port-release
- * check becomes inert.
- */
-function listeningPorts() {
-    const ports = new Set();
-    const ss = spawnSync("ss", ["-tlnH"], { encoding: "utf-8" });
-    if (ss.status === 0 && typeof ss.stdout === "string") {
-        for (const m of ss.stdout.matchAll(/:(\d+)\s/g))
-            ports.add(Number(m[1]));
-        return ports;
-    }
-    // Rows look like: `bun 123 user 4u IPv4 0x… 0t0 TCP 127.0.0.1:58055 (LISTEN)`.
-    // Status can be nonzero while stdout still holds usable rows (lsof reports a
-    // failure when any single process is unreadable), so judge it on the output.
-    const lsof = spawnSync("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"], { encoding: "utf-8" });
-    if (typeof lsof.stdout === "string") {
-        for (const m of lsof.stdout.matchAll(/:(\d+) \(LISTEN\)$/gm))
-            ports.add(Number(m[1]));
-    }
-    return ports;
-}
 /**
  * Pick a gate port for a new instance. An explicit `--gate-port` is honored
  * (and rejected if it's already taken); otherwise scan upward from 9001 for the
  * first port that's neither held by a live instance nor currently listening.
  */
-function allocateGatePort(preferred) {
+async function allocateGatePort(preferred) {
     const used = new Set(listStates()
         .filter((s) => isProcessAlive(s.gate_pid))
         .map((s) => s.gate_port));
+    // No discovery tool (null) is not "every port free": probe candidates by connecting.
     const listening = listeningPorts();
-    const taken = (p) => used.has(p) || listening.has(p);
+    const taken = async (p) => used.has(p) || (listening ? listening.has(p) : await connectProbe(p));
     if (preferred !== undefined) {
-        if (taken(preferred)) {
+        if (await taken(preferred)) {
             emit.error({
                 code: "tunnel_port_taken",
                 message: `Gate port ${preferred} is already in use. Omit --gate-port to auto-allocate, or pick a free one.`,
@@ -245,7 +285,7 @@ function allocateGatePort(preferred) {
         return preferred;
     }
     for (let p = DEFAULT_GATE_PORT; p <= MAX_GATE_PORT; p++) {
-        if (!taken(p))
+        if (!(await taken(p)))
             return p;
     }
     emit.error({
@@ -393,13 +433,14 @@ function tunnelIsAlive(state) {
  * is passed as an env var, which the gate snapshots at module load and never
  * re-reads — that snapshot is precisely why `reload` has to exist.
  */
-function spawnGate(o) {
+function spawnGate(o, launch) {
     // `--name`/`--port` on argv mirror the env vars; they're what makes the gate
-    // process distinguishable per-instance in `pgrep -f` (see sweepStrays).
+    // process distinguishable per-instance in a command-line search (see sweepStrays).
     const gateProc = spawnRotatingProcess({
         path: o.gateLogPath,
-        command: "bun",
-        arguments: ["run", gateScriptPath(), "--name", o.name, "--port", String(o.gatePort)],
+        command: launch.command,
+        arguments: [...launch.arguments, "--name", o.name, "--port", String(o.gatePort)],
+        worker: currentWorkerLaunch(),
         env: {
             ...process.env,
             HARNERY_TUNNEL_ALLOW: o.allowedIps.join(","),
@@ -414,12 +455,9 @@ function spawnGate(o) {
     return gateProc;
 }
 async function up(opts) {
-    if (!bunAvailable()) {
-        emit.error({
-            code: "tunnel_requires_bun",
-            message: "harn tunnel requires Bun: the gate worker is a Bun.serve process. " +
-                "Install Bun (https://bun.sh) and re-run. (Every other harn command runs on Node.)",
-        });
+    const launch = currentGateLaunch();
+    if (!launch) {
+        emit.error({ code: "tunnel_requires_bun", message: requiresBunMessage() });
         process.exit(1);
     }
     const name = resolveName(opts.name);
@@ -459,7 +497,7 @@ async function up(opts) {
         downOne(name, new Set());
     // Allocate the gate port (after clearing dead state so its old port frees up
     // for reuse). Explicit --gate-port is validated; otherwise auto-scan.
-    const gatePort = allocateGatePort(opts.gatePort ? Number(opts.gatePort) : undefined);
+    const gatePort = await allocateGatePort(opts.gatePort ? Number(opts.gatePort) : undefined);
     // Self-heal: clear any orphaned gate/cloudflared on THIS instance's port from
     // a prior crashed or state-cleared run so the gate port is free before we bind.
     if (sweepStrays(gatePort, new Set()))
@@ -468,11 +506,23 @@ async function up(opts) {
     if (provider === "cloudflare" && cfg.allowed_ips.length === 0) {
         emit.error({
             code: "tunnel_allowlist_empty",
-            message: "Allowlist is empty; refusing to start. Add an IP first: harn tunnel allow add <ip>",
+            message: `Allowlist is empty; refusing to start. Add an IP first: ${resolveBinName()} tunnel allow add <ip> (or --current)`,
         });
         process.exit(1);
     }
-    const cloudflaredBin = provider === "cloudflare" ? ensureCloudflared() : null;
+    let cloudflaredBin = null;
+    if (provider === "cloudflare") {
+        try {
+            cloudflaredBin = ensureCloudflared();
+        }
+        catch (error) {
+            emit.error({
+                code: "tunnel_cloudflared_missing",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    }
     if (provider === "tailscale" && !tailscaleAvailable()) {
         emit.error({
             code: "tunnel_tailscale_missing",
@@ -492,9 +542,18 @@ async function up(opts) {
         allowedIps: cfg.allowed_ips,
         allowPaths,
         gateLogPath,
-    });
+    }, launch);
     await sleep(800);
-    if (!isProcessAlive(gateProc.pid)) {
+    // A host CLI that re-executes itself takes longer to load than a bare script,
+    // so wait for the gate to actually listen before the provider forwards to it.
+    if (!isProcessAlive(gateProc.pid) || !(await waitForPortBound(gatePort, 15_000))) {
+        try {
+            process.kill(gateProc.pid);
+        }
+        catch {
+            /* already dead */
+        }
+        sweepStrays(gatePort, new Set());
         emit.error({
             code: "tunnel_gate_failed",
             message: `Gate failed to start. Check log: ${gateLogPath}`,
@@ -514,6 +573,7 @@ async function up(opts) {
             path: providerLogPath,
             command: cloudflaredBin,
             arguments: ["tunnel", "--protocol", "http2", "--url", `http://localhost:${gatePort}`],
+            worker: currentWorkerLaunch(),
         });
         cfdProc.unref();
         cloudflaredPid = cfdProc.pid;
@@ -567,7 +627,8 @@ async function up(opts) {
     };
     writeState(state);
     recordTunnelServer(state);
-    const stopHint = name === DEFAULT_INSTANCE ? "harn tunnel down" : `harn tunnel down --name ${name}`;
+    const bin = resolveBinName();
+    const stopHint = name === DEFAULT_INSTANCE ? `${bin} tunnel down` : `${bin} tunnel down --name ${name}`;
     emit.text(`\n  Instance: ${name}\n`);
     emit.text(`  Provider: ${provider}${tailscaleMode ? ` (${tailscaleMode})` : ""}\n`);
     emit.text(`  URL: ${url}\n\n`);
@@ -584,10 +645,10 @@ async function up(opts) {
             : "  Visibility: tailnet only via Tailscale Serve\n\n");
     }
     if (!registered) {
-        emit.text(`  ⚠ Edge connection didn't register within 30s (QUIC can wedge on a cold\n    start). If the URL 404s or times out, bounce it: ${stopHint} && harn tunnel up\n\n`);
+        emit.text(`  ⚠ Edge connection didn't register within 30s (QUIC can wedge on a cold\n    start). If the URL 404s or times out, bounce it: ${stopHint} && ${bin} tunnel up\n\n`);
     }
     emit.text(`  Stop:   ${stopHint}\n`);
-    emit.text("  Status: harn tunnel status\n");
+    emit.text(`  Status: ${bin} tunnel status\n`);
 }
 /** The server registry lists tunnels beside every other local server. */
 function registryRoot() {
@@ -598,7 +659,10 @@ function recordTunnelServer(state) {
     tryRegisterServer(tunnelServerInput(state, coordRoot), { coordRoot });
 }
 /** Tear down a single instance by name. Returns the number of processes killed. */
-function downOne(name, killed) {
+function portHeldByOtherLiveInstance(port, name) {
+    return listStates().some((s) => s.name !== name && s.gate_port === port && isProcessAlive(s.gate_pid));
+}
+export function downOne(name, killed) {
     const before = killed.size;
     const state = readState(name);
     if (state) {
@@ -619,8 +683,12 @@ function downOne(name, killed) {
         }
     }
     // Fallback: sweep orphans on this instance's gate port, even when state was
-    // lost; they'd otherwise squat on the port and break the next `up`.
-    sweepStrays(state?.gate_port ?? DEFAULT_GATE_PORT, killed);
+    // lost; they'd otherwise squat on the port and break the next `up`. Skip it
+    // when another live instance now owns that port: a stale record's port is
+    // reused after a reboot, and sweeping it would kill the live tunnel there.
+    const port = state?.gate_port ?? DEFAULT_GATE_PORT;
+    if (!portHeldByOtherLiveInstance(port, name))
+        sweepStrays(port, killed);
     clearState(name);
     unregisterServer(tunnelServerId(name), { coordRoot: registryRoot() });
     return killed.size - before;
@@ -644,7 +712,7 @@ function down(opts) {
     if (name === DEFAULT_INSTANCE && !readState(DEFAULT_INSTANCE)) {
         const others = listStates();
         if (others.length > 0) {
-            emit.text(`No default tunnel running. Other tunnels up: ${others.map((s) => s.name).join(", ")}.\nUse \`harn tunnel down --name <name>\` or \`harn tunnel down --all\`.\n`);
+            emit.text(`No default tunnel running. Other tunnels up: ${others.map((s) => s.name).join(", ")}.\nUse \`${resolveBinName()} tunnel down --name <name>\` or \`${resolveBinName()} tunnel down --all\`.\n`);
             return;
         }
     }
@@ -657,21 +725,21 @@ function down(opts) {
 async function waitForPortFree(port, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
-        if (!listeningPorts().has(port))
+        if (!(await portListening(port)))
             return true;
         await sleep(100);
     }
-    return !listeningPorts().has(port);
+    return !(await portListening(port));
 }
 /** Poll until `port` has a LISTEN socket (or the deadline passes). */
 async function waitForPortBound(port, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
-        if (listeningPorts().has(port))
+        if (await portListening(port))
             return true;
         await sleep(100);
     }
-    return listeningPorts().has(port);
+    return portListening(port);
 }
 /**
  * Restart ONE instance's gate in place, deliberately leaving the provider
@@ -695,8 +763,12 @@ export async function reloadOne(state) {
                 `Reloading the gate can't bring it back — run \`${bin} tunnel up --name ${name}\`.`,
         };
     }
-    if (!bunAvailable()) {
-        return { ok: false, message: `[${name}] bun is not on PATH, so the gate can't be respawned.` };
+    const launch = currentGateLaunch();
+    if (!launch) {
+        return {
+            ok: false,
+            message: `[${name}] Bun is not available, so the gate can't be respawned.`,
+        };
     }
     if (state.allow_paths.length === 0) {
         return {
@@ -719,7 +791,7 @@ export async function reloadOne(state) {
             /* race: already gone */
         }
     }
-    killByPattern(`gate\\.ts.*--port ${gatePort}( |$)`, killed);
+    killByPattern(gatePattern(gatePort), killed);
     if (!(await waitForPortFree(gatePort, 5_000))) {
         return {
             ok: false,
@@ -737,12 +809,12 @@ export async function reloadOne(state) {
         allowedIps: cfg.allowed_ips,
         allowPaths: state.allow_paths,
         gateLogPath: tunnelLogDestinations(name, state.provider).gate,
-    });
+    }, launch);
     await sleep(800);
     const pid = gateProc.pid;
     if (typeof pid !== "number" ||
         !isProcessAlive(pid) ||
-        !(await waitForPortBound(gatePort, 5_000))) {
+        !(await waitForPortBound(gatePort, 15_000))) {
         return {
             ok: false,
             message: `[${name}] the gate did not come back on port ${gatePort}. ` +
@@ -902,9 +974,13 @@ function allowList() {
         emit.text("(empty)\n");
         return;
     }
-    for (const ip of cfg.allowed_ips)
-        emit.text(`${ip}\n`);
+    const automatic = cfg.auto_allowed ?? [];
+    for (const ip of cfg.allowed_ips) {
+        emit.text(`${ip}${sameEntryIn(automatic, ip) ? "  (automatic)" : ""}\n`);
+    }
 }
+const canonicalEntry = (entry) => normalizeAllowEntry(entry) ?? entry;
+const sameEntryIn = (list, entry) => list.some((e) => canonicalEntry(e) === canonicalEntry(entry));
 /**
  * Trailer for `allow add`/`allow rm`. Each gate snapshots the allowlist at
  * spawn, so a config edit alone changes nothing until the gates restart.
@@ -920,29 +996,122 @@ function allowChangedHint() {
         `(${live.map((s) => s.name).join(", ")}):\n` +
         `  ${resolveBinName()} tunnel reload --all\n`);
 }
-function allowAdd(ip) {
+async function allowAdd(entry, opts = {}) {
+    if (opts.current) {
+        if (entry) {
+            emit.error({
+                code: "tunnel_allow_current_with_entry",
+                message: "Pass either an address or --current, not both.",
+            });
+            process.exit(1);
+        }
+        const result = await refreshCurrentAddress({ emit, reload: true });
+        if (!result.ok)
+            process.exit(1);
+        return;
+    }
+    if (!entry) {
+        emit.error({
+            code: "tunnel_allow_entry_missing",
+            message: `Name an address or range to allow, or use --current: ${resolveBinName()} tunnel allow add <ip|cidr>`,
+        });
+        process.exit(1);
+    }
+    const canonical = normalizeAllowEntry(entry);
+    if (!canonical) {
+        emit.error({
+            code: "tunnel_allow_entry_invalid",
+            message: `"${entry}" is not an IP address or CIDR range. ` +
+                "Examples: 203.0.113.8, 203.0.113.0/24, 2601:db8:1:2::/64.",
+        });
+        process.exit(1);
+    }
     const cfg = readConfig();
-    if (cfg.allowed_ips.includes(ip)) {
-        emit.text(`${ip} already in allowlist.\n`);
+    if (sameEntryIn(cfg.allowed_ips, canonical)) {
+        // Adding by hand an entry the refresh owns adopts it: later refreshes keep it.
+        if (cfg.auto_allowed && sameEntryIn(cfg.auto_allowed, canonical)) {
+            cfg.auto_allowed = cfg.auto_allowed.filter((e) => canonicalEntry(e) !== canonical);
+            writeConfig(cfg);
+            emit.text(`${canonical} is now a manual entry; automatic refreshes will keep it.\n`);
+            return;
+        }
+        emit.text(`${canonical} already in allowlist.\n`);
         return;
     }
-    cfg.allowed_ips.push(ip);
+    cfg.allowed_ips.push(canonical);
     writeConfig(cfg);
-    emit.text(`Added ${ip}.\n`);
+    emit.text(`Added ${canonical}.\n`);
     allowChangedHint();
 }
-function allowRm(ip) {
+function allowRm(entry) {
     const cfg = readConfig();
-    const idx = cfg.allowed_ips.indexOf(ip);
+    const wanted = canonicalEntry(entry);
+    const idx = cfg.allowed_ips.findIndex((e) => e === entry || canonicalEntry(e) === wanted);
     if (idx === -1) {
-        emit.text(`${ip} not in allowlist.\n`);
+        emit.text(`${entry} not in allowlist.\n`);
         return;
     }
-    cfg.allowed_ips.splice(idx, 1);
+    const [removed] = cfg.allowed_ips.splice(idx, 1);
+    if (cfg.auto_allowed) {
+        cfg.auto_allowed = cfg.auto_allowed.filter((e) => canonicalEntry(e) !== canonicalEntry(removed));
+    }
     writeConfig(cfg);
-    emit.text(`Removed ${ip}.\n`);
+    emit.text(`Removed ${removed}.\n`);
     allowChangedHint();
 }
+/**
+ * `tunnel allow add --current`: allow this machine's own public addresses, as
+ * Cloudflare sees them, and drop the ones allowed by the previous refresh.
+ * Exported so a host CLI can run it before `tunnel up` and from its own sync.
+ */
+export async function refreshCurrentAddress(options) {
+    if (options.emit)
+        emit = options.emit;
+    const detected = await (options.detect ?? detectPublicAddresses)(options.detectOptions);
+    const cfg = readConfig();
+    const plan = planCurrentAddresses(cfg, detected);
+    const noAddress = !detected.v4 && !detected.v6;
+    // Quiet runs (a host's sync) speak only when something changed or nothing
+    // could be detected; "no IPv6 on this network" is not news every time.
+    if (!options.quiet || noAddress || plan.changed) {
+        for (const warning of plan.warnings)
+            emit.text(`  ⚠ ${warning}\n`);
+    }
+    const result = {
+        ok: true,
+        changed: plan.changed,
+        added: plan.added,
+        removed: plan.removed,
+        warnings: plan.warnings,
+    };
+    if (noAddress)
+        return result;
+    writeConfig(plan.config);
+    if (!options.quiet || plan.changed) {
+        const found = [detected.v4, detected.v6].filter(Boolean).join(", ");
+        emit.text(`This machine reaches Cloudflare as ${found}.\n`);
+        emit.text(plan.changed
+            ? `Allowlist updated${plan.added.length ? `: added ${plan.added.join(", ")}` : ""}${plan.removed.length ? `; removed ${plan.removed.join(", ")}` : ""}.\n`
+            : "Allowlist already covers this machine.\n");
+    }
+    if (!plan.changed || !options.reload)
+        return result;
+    const live = listStates().filter((s) => s.provider === "cloudflare" && providerIsAlive(s));
+    for (const s of live) {
+        const r = await reloadOne(s);
+        emit.text(`${r.ok ? "ok  " : "FAIL"} ${r.message}\n`);
+        if (!r.ok)
+            result.ok = false;
+    }
+    return result;
+}
+/** Hidden task: run the gate worker in this process (the self-launch form of the gate). */
+async function runGateInProcess() {
+    await import("../lib/tunnel/gate.js");
+    // The gate's server keeps the process alive. Never resolve, so a host's
+    // post-command exit or output finalization cannot end the worker.
+    await new Promise(() => { });
+}
 let emit;
 let context;
 export function registerTunnelCommand(program, emitParam, contextParam) {
@@ -994,9 +1163,29 @@ export function registerTunnelCommand(program, emitParam, contextParam) {
         .action(logs);
     const allow = cmd
         .command("allow")
-        .description("Manage the Cloudflare CF-Connecting-IP allowlist")
+        .description("Manage the Cloudflare CF-Connecting-IP allowlist (addresses and CIDR ranges, IPv4 and IPv6)")
         .action(allowList);
-    allow.command("add <ip>").description("Add an IP to the allowlist").action(allowAdd);
-    allow.command("rm <ip>").description("Remove an IP from the allowlist").action(allowRm);
-    allow.command("list").description("List allowed IPs (default action)").action(allowList);
+    allow
+        .command("add [entry]")
+        .description("Add an IP address or CIDR range (203.0.113.0/24, 2601:db8:1:2::/64), or --current for this machine")
+        .option("--current", "allow this machine's public addresses as Cloudflare sees them (IPv4 /32 and IPv6 /64), " +
+        "replace the ones the previous --current added, and reload running gates")
+        .action(allowAdd);
+    allow
+        .command("rm <entry>")
+        .description("Remove an address or range from the allowlist")
+        .action(allowRm);
+    allow.command("list").description("List allowed entries (default action)").action(allowList);
+    cmd
+        .command("log-worker <specification>", { hidden: true })
+        .description("Internal: run the output-rotating wrapper for one tunnel process")
+        .action(async (specification) => {
+        await runProcessLogWorker(specification);
+    });
+    cmd
+        .command("gate", { hidden: true })
+        .description("Internal: run the gate worker in this process")
+        .option("--name <name>", "instance name")
+        .option("--port <port>", "port to listen on")
+        .action(runGateInProcess);
 }

package/dist/commands/web-fetch.d.ts

@@ -1,10 +1,11 @@
+import { spawnSync } from "node:child_process";
 import type { EmitContext } from "../commander.js";
 /** bun if available (preferred), else npm. Both support `<runner> install` and `<runner> run <script>`. */
-export declare function webRunner(): "bun" | "npm";
+export declare function webRunner(spawn?: typeof spawnSync): "bun" | "npm";
 /**
  * Ensure a cached harnery checkout's `web/` exists for this version and return
  * its path, fetching (clone + install) on first use. Returns null on failure
  * (after emitting an actionable error).
  */
-export declare function lazyFetchWebRoot(emit: EmitContext): string | null;
+export declare function lazyFetchWebRoot(emit: EmitContext, spawn?: typeof spawnSync): string | null;
 //# sourceMappingURL=web-fetch.d.ts.map

package/dist/commands/web-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-fetch.d.ts","sourceRoot":"","sources":["../../src/commands/web-fetch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiDnD,2GAA2G;AAC3G,wBAAgB,SAAS,IAAI,KAAK,GAAG,KAAK,CAGzC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAmDjE"}
+{"version":3,"file":"web-fetch.d.ts","sourceRoot":"","sources":["../../src/commands/web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmDnD,2GAA2G;AAC3G,wBAAgB,SAAS,CAAC,KAAK,GAAE,OAAO,SAAqB,GAAG,KAAK,GAAG,KAAK,CAG5E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,OAAO,SAAqB,GAClC,MAAM,GAAG,IAAI,CAyDf"}