harnery 0.42.0 → 0.44.0

package/dist/commands/governor.js

@@ -250,12 +250,13 @@ function registerServiceCommand(governor, registry, emit) {
         .action(async (opts) => {
         await withGovernorRootAsync(emit, async (coordRoot) => {
             let status = requestGovernorServiceStop(coordRoot);
+            const signal = { signal_sent: status.signal_sent, signal_verdict: status.signal_verdict };
             const deadline = Date.now() + 5_000;
             while (status.running && Date.now() < deadline) {
                 await delay(50);
                 status = readGovernorServiceStatus(coordRoot);
             }
-            emitServiceStatus(status, opts.json, emit);
+            emitServiceStatus({ ...status, ...signal }, opts.json, emit);
         });
     });
     service
@@ -372,19 +373,30 @@ function emitServiceStatus(status, json, emit) {
         emit.data(status);
         return;
     }
-    if (!status.config && !status.record) {
-        emit.text("governor service: unconfigured\n");
-        return;
-    }
-    const state = status.running
-        ? (status.record?.state ?? "running")
-        : status.stale
-            ? "stale"
-            : "stopped";
+    const state = status.liveness === "unknown"
+        ? "unknown"
+        : !status.config && !status.record
+            ? "unconfigured"
+            : status.running
+                ? (status.record?.state ?? "running")
+                : status.stale
+                    ? "stale"
+                    : "stopped";
     const lines = [
         `governor service: ${state}`,
+        `generation: ${status.generation}`,
+        `liveness: ${status.liveness}`,
+        `running build: ${status.running_build ? `${status.running_build.version} (${status.running_build.revision})` : "unknown"}`,
+        `installed build: ${status.installed_build.version} (${status.installed_build.revision})`,
+        `build: ${status.build_status}`,
         `goals: ${status.config?.goal_ids.join(", ") || "none"}`,
     ];
+    if (status.signal_sent !== undefined) {
+        lines.push(`signal sent: ${status.signal_sent ? "yes" : "no"} (${status.signal_verdict})`);
+        if (!status.signal_sent && status.record?.state !== "stopped") {
+            lines.push("The durable stop request remains for the service to read.");
+        }
+    }
     if (status.record) {
         lines.push(`pid: ${status.record.pid} on ${status.record.host}`);
         lines.push(`heartbeat: ${status.record.heartbeat_at}`);

package/dist/commands/inbox.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
 import type { HarneryInboxService } from "../core/inbox/service.js";
-export declare function registerInboxCommand(program: Command, emit: EmitContext, service?: HarneryInboxService): void;
+export declare function registerInboxCommand(program: Command, emit: EmitContext, service?: HarneryInboxService, defaultRecipient?: () => string): void;
 //# sourceMappingURL=inbox.d.ts.map

package/dist/commands/inbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbox.d.ts","sourceRoot":"","sources":["../../src/commands/inbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,IAAI,CAmCN"}
+{"version":3,"file":"inbox.d.ts","sourceRoot":"","sources":["../../src/commands/inbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAC9B,IAAI,CA6EN"}

package/dist/commands/inbox.js

@@ -1,10 +1,12 @@
-export function registerInboxCommand(program, emit, service) {
+import { watchInbox } from "../core/inbox/watcher.js";
+export function registerInboxCommand(program, emit, service, defaultRecipient) {
     const inbox = program.command("inbox").description("Inspect private coordination inbox state");
     inbox
-        .command("list <recipient>")
+        .command("list [recipient]")
         .option("--json", "Emit stable JSON")
         .action((recipient, options) => {
         run(emit, () => {
+            recipient = requireRecipient(recipient, defaultRecipient);
             const rows = requireInboxService(service)
                 .pending(recipient)
                 .map((record) => ({
@@ -14,6 +16,7 @@ export function registerInboxCommand(program, emit, service) {
                 created_at: record.created_at,
                 body_bytes: record.body_bytes,
                 body: record.body,
+                state: "pending",
             }));
             if (options.json) {
                 emit.config({ format: "json" });
@@ -37,6 +40,56 @@ export function registerInboxCommand(program, emit, service) {
                 emit.rows([status]);
         });
     });
+    inbox
+        .command("watch [recipient]")
+        .description("Surface pending messages for this instance; poll history until timeout")
+        .option("--timeout <seconds>", "Stop after this many seconds", "60")
+        .option("--json", "Emit one JSON record per surfaced message")
+        .action(async (recipient, options) => {
+        let controller;
+        let timer;
+        try {
+            const instanceId = requireRecipient(recipient, defaultRecipient);
+            const inboxService = requireInboxService(service);
+            const seconds = Number(options.timeout);
+            if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 3600)
+                throw new Error("--timeout must be greater than 0 and at most 3600 seconds");
+            controller = new AbortController();
+            timer = setTimeout(() => controller.abort(), seconds * 1000);
+            if (options.json)
+                emit.config({ format: "json" });
+            for await (const message of watchInbox(inboxService, instanceId, {
+                signal: controller.signal,
+            })) {
+                const row = { ...message, state: "surfaced" };
+                if (options.json)
+                    emit.data(row);
+                else
+                    emit.rows([row]);
+                // An output error leaves this ID pending for prompt recovery.
+                await new Promise((resolve, reject) => process.stdout.write("", (error) => (error ? reject(error) : resolve())));
+                inboxService.acknowledgeSurface(instanceId, [message.message_id]);
+            }
+        }
+        catch (error) {
+            emit.error({
+                code: "inbox_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            emit.setExitCode(1);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            controller?.abort();
+        }
+    });
+}
+function requireRecipient(recipient, fallback) {
+    const resolved = recipient ?? fallback?.();
+    if (!resolved)
+        throw new Error("recipient instance is required outside an agent session");
+    return resolved;
 }
 function requireInboxService(service) {
     if (!service)

package/dist/commands/rm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rm.d.ts","sourceRoot":"","sources":["../../src/commands/rm.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAU1E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAgFN"}
+{"version":3,"file":"rm.d.ts","sourceRoot":"","sources":["../../src/commands/rm.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAW1E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAsHN"}

package/dist/commands/rm.js

@@ -1,7 +1,8 @@
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { resolveCoordRoot } from "../core/agents/coord-client.js";
+import { artifactsRoot, parseArtifactManifest } from "../core/artifacts/index.js";
 import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from "../core/events/v3/coordination-view.js";
 import { liveInstanceIdV3 } from "../core/events/v3/live-route-observer.js";
 import { resolveOwner } from "../core/hooks/resolve/owner.js";
@@ -12,6 +13,8 @@ export function registerRmCommand(program, emit, context) {
         .description("Preview guarded removal of untracked files; --yes applies permanent deletion")
         .requiredOption("--root <directory>", "Allowed directory; each target must be strictly inside it")
         .option("-r, --recursive", "Permit directory removal after inspecting its complete contents")
+        .option("--clean-clone", "Remove only clean standalone clones inside one owned artifact; refuse local-only commits and worktrees")
+        .option("--entry-limit <n>", "Maximum inspected entries, 1-100000 (default 10000); larger limits require one current caller-owned managed artifact as --root", (value) => Number(value))
         .option("--allow-protected <path>", "Remove this one protected path (Git metadata, credentials, Harnery state, keys) inside a target; repeat per path", (value, previous = []) => [...previous, value])
         .option("--yes", "Permanently remove validated targets")
         .option("--dry-run", "Preview only, even with --yes")
@@ -43,7 +46,26 @@ export function registerRmCommand(program, emit, context) {
             // The workspace this command coordinates, and the checkout it runs in:
             // their own .git and .harnery can never be allowed.
             const liveRoots = [coordRoot, gitTopLevel(process.cwd())].filter((dir) => Boolean(dir));
-            const report = guardedRemove(paths, { ...options, liveRoots }, checkClaims);
+            const assertOwnedArtifact = (root) => {
+                if (!coordRoot || dirname(root) !== realpathSync(artifactsRoot(coordRoot)))
+                    throw new Error("Copied state requires --root to name one owned managed artifact");
+                const view = requireAuthoritySafeCoordinationViewV3(readCoordinationViewV3(coordRoot));
+                const owner = resolveOwner({ payload: null, coordRoot });
+                const ownId = owner ? liveInstanceIdV3(owner.instance_id) : undefined;
+                if (!ownId || !view.instances[ownId]?.authority_eligible)
+                    throw new Error("Copied state requires an authenticated current artifact owner");
+                const record = resolve(root, ".harnery-artifact.json");
+                const stat = lstatSync(record);
+                if (!stat.isFile() || stat.isSymbolicLink())
+                    throw new Error("An owned artifact requires a regular manifest file");
+                const parsed = parseArtifactManifest(JSON.parse(readFileSync(record, "utf8")));
+                if (!parsed.ok ||
+                    parsed.manifest.released_at ||
+                    !parsed.manifest.created_by?.instance_id ||
+                    liveInstanceIdV3(parsed.manifest.created_by.instance_id) !== ownId)
+                    throw new Error("Copied state requires a valid unreleased artifact owned by the caller");
+            };
+            const report = guardedRemove(paths, { ...options, liveRoots, assertOwnedArtifact }, checkClaims);
             if (options.json) {
                 emit.config({ format: "json" });
                 emit.data(report);
@@ -54,7 +76,9 @@ export function registerRmCommand(program, emit, context) {
                     ...report.targets,
                 ];
                 if (report.protected.length)
-                    lines.push("Protected paths named with --allow-protected:", ...report.protected.map((path) => `  ${path}`));
+                    lines.push(options.cleanClone
+                        ? "Verified clone metadata:"
+                        : "Protected paths named with --allow-protected:", ...report.protected.map((path) => `  ${path}`));
                 if (report.links.length)
                     lines.push("Links removed as links (their targets are untouched):", ...report.links.map((link) => `  ${link.path} -> ${link.target}`));
                 if (!report.applied)

package/dist/commands/servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../../src/commands/servers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG1E,OAAO,EAWL,KAAK,aAAa,EAMnB,MAAM,0BAA0B,CAAC;AAElC,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA0YN;AA8BD,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmDvE"}
+{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../../src/commands/servers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG1E,OAAO,EAWL,KAAK,aAAa,EAMnB,MAAM,0BAA0B,CAAC;AAElC,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAsZN;AA8BD,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmDvE"}

package/dist/commands/servers.js

@@ -81,6 +81,7 @@ export function registerServersCommand(program, emit, context) {
                     type: "unregistered",
                     label: stray.command,
                     pid: stray.pid,
+                    ...(stray.start_token ? { start_token: stray.start_token } : {}),
                     host: hostname(),
                     started_at: new Date().toISOString(),
                     registered_at: new Date().toISOString(),
@@ -141,7 +142,19 @@ export function registerServersCommand(program, emit, context) {
                 emit.data({ applied: Boolean(options.yes), pruned: report.pruned, decisions, results });
             }
             else {
-                const lines = decisions.map((d) => `${d.action === "stop" ? (options.yes ? "stopped" : "would stop") : "keep"}  ${d.id}  ${d.reason}`);
+                const lines = decisions.map((decision) => {
+                    const result = results.find((item) => item.id === decision.id);
+                    const action = decision.action === "keep"
+                        ? "keep"
+                        : !options.yes
+                            ? "would stop"
+                            : result?.stopped
+                                ? "stopped"
+                                : result?.method === "not-running"
+                                    ? "already stopped"
+                                    : "could not stop";
+                    return `${action}  ${decision.id}  ${result?.detail ?? decision.reason}`;
+                });
                 if (report.pruned.length)
                     lines.push(`Removed records of exited servers: ${report.pruned.join(", ")}`);
                 if (!decisions.length)
@@ -150,6 +163,8 @@ export function registerServersCommand(program, emit, context) {
                     lines.push("Preview only. Re-run with --yes to stop.");
                 emit.text(lines.join("\n"));
             }
+            if (results.some((result) => result.method === "refused"))
+                emit.setExitCode(1);
         }
         catch (error) {
             fail(error);

package/dist/commands/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAe1E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAwGN"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAe1E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA6GN"}

package/dist/commands/supervisor.js

@@ -53,11 +53,16 @@ export function registerSupervisorCommand(program, emit, context) {
         .action(async (options) => {
         try {
             const root = resolve(options.root ?? coordRoot(context));
-            let status = requestSupervisorStop(root);
+            const requested = requestSupervisorStop(root);
+            let status = requested;
             const deadline = Date.now() + 5_000;
             while (status.running && Date.now() < deadline) {
                 await new Promise((done) => setTimeout(done, 50));
-                status = readSupervisorStatus(root);
+                status = {
+                    ...readSupervisorStatus(root),
+                    signal_sent: requested.signal_sent,
+                    signal_verdict: requested.signal_verdict,
+                };
             }
             emit.data(status);
         }

package/dist/commands/toc.d.ts

@@ -1,5 +1,19 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
+interface SectionOpts {
+    json?: boolean;
+    caseSensitive?: boolean;
+}
+interface SectionResult {
+    file: string;
+    matched_header: string;
+    matched_level: number;
+    line_start: number;
+    line_end: number;
+    content: string;
+}
 export declare function registerTocCommand(program: Command, emit: EmitContext): void;
 export declare function registerSectionCommand(program: Command, emit: EmitContext): void;
+export declare function runSection(file: string, query: string, opts: SectionOpts): Promise<SectionResult>;
+export {};
 //# sourceMappingURL=toc.d.ts.map

package/dist/commands/toc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toc.d.ts","sourceRoot":"","sources":["../../src/commands/toc.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA4CnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqB5E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA0BhF"}
+{"version":3,"file":"toc.d.ts","sourceRoot":"","sources":["../../src/commands/toc.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiBnD,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAeD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqB5E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA0BhF;AA8ED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CA+CxB"}

package/dist/commands/toc.js

@@ -116,15 +116,18 @@ function renderToc(r) {
     }
     return lines.join("\n");
 }
-async function runSection(file, query, opts) {
+export async function runSection(file, query, opts) {
     if (!query.trim())
         throw new Error("header query required");
     const tocResult = await runToc(file, {});
     const absPath = resolve(file);
     const lines = readFileSync(absPath, "utf8").split("\n");
-    const matches = tocResult.headers.filter((h) => opts.caseSensitive
-        ? h.text.includes(query)
-        : h.text.toLowerCase().includes(query.toLowerCase()));
+    const same = (a, b) => opts.caseSensitive ? a === b : a.toLowerCase() === b.toLowerCase();
+    const contains = (a, b) => opts.caseSensitive ? a.includes(b) : a.toLowerCase().includes(b.toLowerCase());
+    // A header that equals the query wins over headers that merely contain it,
+    // so "Media" can still select "## Media" beside "## Media recipes".
+    const exact = tocResult.headers.filter((h) => same(h.text, query.trim()));
+    const matches = exact.length > 0 ? exact : tocResult.headers.filter((h) => contains(h.text, query));
     if (matches.length === 0) {
         throw new Error(`no header matching "${query}". Run \`${resolveBinName()} toc ${file}\` to list available headers.`);
     }

package/dist/commands/tunnel.d.ts

@@ -1,10 +1,48 @@
 import type { Command } from "commander";
 import type { EmitContext, HarneryProgramContext } from "../commander.js";
+import { type DetectOptions, detectPublicAddresses } from "../lib/tunnel/current-address.js";
 import { type TunnelProvider, type TunnelState } from "../lib/tunnel/state.js";
 export declare function tunnelLogDestinations(name: string, provider: TunnelProvider, env?: NodeJS.ProcessEnv, root?: string): {
     gate: string;
     provider: string;
 };
+export interface GateLaunch {
+    command: string;
+    /** Arguments before the gate's own `--name` and `--port`. */
+    arguments: string[];
+}
+export interface GateLaunchInputs {
+    /** Absolute path of `lib/tunnel/gate.ts` beside this file, whether or not it exists. */
+    gateScript: string;
+    gateScriptExists: boolean;
+    /** True when this process runs on Bun (so `execPath` is a Bun binary). */
+    underBun: boolean;
+    execPath: string;
+    /** The script this process was started with (`argv[1]`): the host CLI's entry or bundle. */
+    entryScript: string | undefined;
+    entryScriptExists: boolean;
+    bunOnPath: boolean;
+}
+/**
+ * How to start the gate worker, which is a `Bun.serve` process (HTTP and
+ * WebSocket reverse proxy):
+ *   1. From a source or package checkout, `gate.ts` sits beside this module and
+ *      runs directly.
+ *   2. Inside a single-file bundle there is no such file. The CLI then
+ *      re-executes itself with the hidden `tunnel gate` task, which loads the
+ *      gate in-process. This uses the running Bun binary, so Bun need not be
+ *      on PATH.
+ * Null means neither works (a Node host with no Bun, or an unknown entry).
+ */
+export declare function resolveGateLaunch(i: GateLaunchInputs): GateLaunch | null;
+/**
+ * How to start the log wrapper that rotates each process's output. Beside a
+ * source or package checkout the default (this package's own wrapper file)
+ * works; inside a single-file bundle the CLI re-executes itself with the hidden
+ * `tunnel log-worker` task instead.
+ */
+export declare function resolveWorkerLaunch(i: GateLaunchInputs): GateLaunch | undefined;
+export declare function downOne(name: string, killed: Set<number>): number;
 /**
  * Restart ONE instance's gate in place, deliberately leaving the provider
  * process running.
@@ -20,5 +58,32 @@ export declare function reloadOne(state: TunnelState): Promise<{
     ok: boolean;
     message: string;
 }>;
+export interface RefreshCurrentOptions {
+    emit?: EmitContext;
+    /** Reload running Cloudflare gates after an allowlist change, keeping their URLs. */
+    reload: boolean;
+    /** Speak only when the allowlist changed or no address could be detected. */
+    quiet?: boolean;
+    /** Lookup timeout and retries; a sync that must not stall offline passes small ones. */
+    detectOptions?: DetectOptions;
+    /** Replaces the lookup (tests). */
+    detect?: typeof detectPublicAddresses;
+}
+export interface RefreshCurrentResult {
+    /** False only when a requested reload of a live gate failed. A failed lookup is a warning, not a failure. */
+    ok: boolean;
+    /** The allowlist gained or lost an entry. */
+    changed: boolean;
+    /** Entries newly allowed. */
+    added: string[];
+    removed: string[];
+    warnings: string[];
+}
+/**
+ * `tunnel allow add --current`: allow this machine's own public addresses, as
+ * Cloudflare sees them, and drop the ones allowed by the previous refresh.
+ * Exported so a host CLI can run it before `tunnel up` and from its own sync.
+ */
+export declare function refreshCurrentAddress(options: RefreshCurrentOptions): Promise<RefreshCurrentResult>;
 export declare function registerTunnelCommand(program: Command, emitParam: EmitContext, contextParam?: HarneryProgramContext): void;
 //# sourceMappingURL=tunnel.d.ts.map

package/dist/commands/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgB1E,OAAO,EAYL,KAAK,cAAc,EACnB,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAuDhC,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,SAAgB,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAcpC;AA2sBD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiF7F;AAkND,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CAkFN"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAiB1E,OAAO,EACL,KAAK,aAAa,EAClB,qBAAqB,EAEtB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EAYL,KAAK,cAAc,EACnB,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAyDhC,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,SAAgB,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAcpC;AAmHD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,GAAG,UAAU,GAAG,IAAI,CAWxE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAM/E;AA2iBD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CA0BjE;AA2DD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAwF7F;AAoQD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mCAAmC;IACnC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,6GAA6G;IAC7G,EAAE,EAAE,OAAO,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAuC/B;AAaD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CA+GN"}