lunel-cli 0.1.33 → 0.1.35

package/dist/index.js

@@ -19,6 +19,7 @@ const __require = createRequire(import.meta.url);
 const VERSION = __require("../package.json").version;
 const PTY_RELEASE_INFO_URL = process.env.LUNEL_PTY_INFO_URL ||
     "https://raw.githubusercontent.com/ssbharambe-m/pty-releases/refs/heads/main/info.json";
+const VERBOSE_AI_LOGS = process.env.LUNEL_DEBUG_AI === "1";
 // Root directory - sandbox all file operations to this
 const ROOT_DIR = process.cwd();
 // Terminal sessions (managed by Rust PTY binary)
@@ -43,9 +44,72 @@ let activeControlWs = null;
 let activeDataWs = null;
 const activeTunnels = new Map();
 const PORT_SYNC_INTERVAL_MS = 30_000;
+const CLI_LOCAL_TCP_CONNECT_TIMEOUT_MS = 2_500;
+const PROXY_WS_CONNECT_TIMEOUT_MS = 12_000;
+const TUNNEL_SETUP_BUDGET_MS = 18_000;
+const PROXY_WS_CONNECT_RETRY_ATTEMPTS = 1;
+const PROXY_WS_RETRY_JITTER_MIN_MS = 200;
+const PROXY_WS_RETRY_JITTER_MAX_MS = 500;
+const PROXY_TUNNEL_LINGER_MS = 1_200;
 let portSyncTimer = null;
 let portScanInFlight = false;
 let lastDiscoveredPorts = [];
+function redactSensitive(input) {
+    const text = typeof input === "string" ? input : JSON.stringify(input);
+    return text
+        .replace(/([A-Za-z0-9\-_]{20,}\.[A-Za-z0-9\-_]{20,}\.[A-Za-z0-9\-_]{20,})/g, "[redacted_jwt]")
+        .replace(/(password|token|authorization|resumeToken|x-manager-password)\s*[:=]\s*["']?[^"',\s}]+/gi, "$1=[redacted]")
+        .replace(/[A-Za-z0-9+/=_-]{40,}/g, "[redacted_secret]");
+}
+function parseProxyControlFrame(raw) {
+    const text = typeof raw === "string" ? raw : Buffer.isBuffer(raw) ? raw.toString("utf-8") : null;
+    if (!text)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed?.v !== 1 || parsed?.t !== "proxy_ctrl")
+            return null;
+        if (parsed.action !== "fin" && parsed.action !== "rst")
+            return null;
+        return {
+            v: 1,
+            t: "proxy_ctrl",
+            action: parsed.action,
+            reason: typeof parsed.reason === "string" ? parsed.reason : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function sendProxyControl(tunnel, action, reason) {
+    if (tunnel.proxyWs.readyState !== WebSocket.OPEN)
+        return;
+    const frame = { v: 1, t: "proxy_ctrl", action, reason };
+    tunnel.proxyWs.send(JSON.stringify(frame));
+}
+function maybeFinalizeTunnel(tunnelId) {
+    const tunnel = activeTunnels.get(tunnelId);
+    if (!tunnel || tunnel.closing)
+        return;
+    if (!tunnel.localEnded || !tunnel.remoteEnded)
+        return;
+    if (tunnel.finalizeTimer)
+        return;
+    tunnel.finalizeTimer = setTimeout(() => {
+        const current = activeTunnels.get(tunnelId);
+        if (!current || current.closing)
+            return;
+        current.closing = true;
+        activeTunnels.delete(tunnelId);
+        if (!current.tcpSocket.destroyed) {
+            current.tcpSocket.destroy();
+        }
+        if (current.proxyWs.readyState === WebSocket.OPEN || current.proxyWs.readyState === WebSocket.CONNECTING) {
+            current.proxyWs.close();
+        }
+    }, PROXY_TUNNEL_LINGER_MS);
+}
 // Popular development server ports to scan on connect
 const DEV_PORTS = [
     1234, // Parcel
@@ -1375,30 +1439,36 @@ function requireData(response, label) {
         const errMsg = response.error
             ? (typeof response.error === "string" ? response.error : JSON.stringify(response.error))
             : `${label} returned no data`;
-        console.error(`[ai] ${label} failed:`, errMsg, "raw response:", JSON.stringify(response).substring(0, 500));
+        console.error(`[ai] ${label} failed:`, redactSensitive(errMsg), "raw response:", redactSensitive(JSON.stringify(response).substring(0, 500)));
         throw new Error(errMsg);
     }
     return response.data;
 }
 async function handleAiCreateSession(payload) {
     const title = payload.title || undefined;
-    console.log("[ai] createSession called, title:", title);
+    if (VERBOSE_AI_LOGS)
+        console.log("[ai] createSession called");
     try {
         const response = await opencodeClient.session.create({ body: { title } });
-        console.log("[ai] createSession response ok:", !!response.data, "error:", response.error ? JSON.stringify(response.error).substring(0, 200) : "none");
+        if (VERBOSE_AI_LOGS) {
+            console.log("[ai] createSession response ok:", !!response.data, "error:", response.error ? redactSensitive(JSON.stringify(response.error).substring(0, 200)) : "none");
+        }
         return { session: requireData(response, "session.create") };
     }
     catch (err) {
-        console.error("[ai] createSession exception:", err.message, err.stack);
+        console.error("[ai] createSession exception:", redactSensitive(err.message));
         throw err;
     }
 }
 async function handleAiListSessions() {
-    console.log("[ai] listSessions called");
+    if (VERBOSE_AI_LOGS)
+        console.log("[ai] listSessions called");
     try {
         const response = await opencodeClient.session.list();
         const data = requireData(response, "session.list");
-        console.log("[ai] listSessions returned", Array.isArray(data) ? data.length : typeof data, "sessions");
+        if (VERBOSE_AI_LOGS) {
+            console.log("[ai] listSessions returned", Array.isArray(data) ? data.length : typeof data, "sessions");
+        }
         return { sessions: data };
     }
     catch (err) {
@@ -1420,7 +1490,8 @@ async function handleAiDeleteSession(payload) {
 }
 async function handleAiGetMessages(payload) {
     const id = payload.id;
-    console.log("[ai] getMessages called, sessionId:", id);
+    if (VERBOSE_AI_LOGS)
+        console.log("[ai] getMessages called");
     try {
         const response = await opencodeClient.session.messages({ path: { id } });
         const raw = requireData(response, "session.messages");
@@ -1432,7 +1503,8 @@ async function handleAiGetMessages(payload) {
             parts: m.parts || [],
             time: m.info.time,
         }));
-        console.log("[ai] getMessages returned", messages.length, "messages");
+        if (VERBOSE_AI_LOGS)
+            console.log("[ai] getMessages returned", messages.length, "messages");
         return { messages };
     }
     catch (err) {
@@ -1445,7 +1517,14 @@ async function handleAiPrompt(payload) {
     const text = payload.text;
     const model = payload.model;
     const agent = payload.agent;
-    console.log("[ai] prompt called, sessionId:", sessionId, "model:", JSON.stringify(model), "agent:", agent, "text:", text.substring(0, 100));
+    if (VERBOSE_AI_LOGS) {
+        console.log("[ai] prompt called", {
+            hasSessionId: Boolean(sessionId),
+            model: redactSensitive(JSON.stringify(model || {})),
+            hasAgent: Boolean(agent),
+            textLength: typeof text === "string" ? text.length : 0,
+        });
+    }
     // Fire and forget — results stream via SSE events forwarded on data channel
     opencodeClient.session.prompt({
         path: { id: sessionId },
@@ -1477,11 +1556,14 @@ async function handleAiAbort(payload) {
     return {};
 }
 async function handleAiAgents() {
-    console.log("[ai] getAgents called");
+    if (VERBOSE_AI_LOGS)
+        console.log("[ai] getAgents called");
     try {
         const response = await opencodeClient.app.agents();
         const data = requireData(response, "app.agents");
-        console.log("[ai] getAgents returned:", JSON.stringify(data).substring(0, 300));
+        if (VERBOSE_AI_LOGS) {
+            console.log("[ai] getAgents returned:", redactSensitive(JSON.stringify(data).substring(0, 300)));
+        }
         return { agents: data };
     }
     catch (err) {
@@ -1490,11 +1572,14 @@ async function handleAiAgents() {
     }
 }
 async function handleAiProviders() {
-    console.log("[ai] getProviders called");
+    if (VERBOSE_AI_LOGS)
+        console.log("[ai] getProviders called");
     try {
         const response = await opencodeClient.config.providers();
         const data = requireData(response, "config.providers");
-        console.log("[ai] getProviders returned", data.providers?.length, "providers, defaults:", JSON.stringify(data.default));
+        if (VERBOSE_AI_LOGS) {
+            console.log("[ai] getProviders returned", data.providers?.length, "providers, defaults:", redactSensitive(JSON.stringify(data.default)));
+        }
         return { providers: data.providers, default: data.default };
     }
     catch (err) {
@@ -1572,7 +1657,7 @@ async function subscribeToOpenCodeEvents(client) {
                 ? parsed.payload
                 : parsed;
             if (!base || typeof base.type !== "string") {
-                console.warn("[sse] Dropped malformed event:", JSON.stringify(parsed).substring(0, 200));
+                console.warn("[sse] Dropped malformed event:", redactSensitive(JSON.stringify(parsed).substring(0, 200)));
                 continue;
             }
             console.log("[sse]", base.type);
@@ -1669,19 +1754,25 @@ function startPortSync(ws) {
 async function handleProxyConnect(payload) {
     const tunnelId = payload.tunnelId;
     const port = payload.port;
+    const setupStartedAt = Date.now();
+    const getRemainingSetupMs = () => TUNNEL_SETUP_BUDGET_MS - (Date.now() - setupStartedAt);
     if (!tunnelId)
         throw Object.assign(new Error("tunnelId is required"), { code: "EINVAL" });
     if (!port)
         throw Object.assign(new Error("port is required"), { code: "EINVAL" });
     if (!currentSessionCode && !currentSessionPassword)
         throw Object.assign(new Error("no active session"), { code: "ENOENT" });
+    if (getRemainingSetupMs() <= 0) {
+        throw Object.assign(new Error("Tunnel setup timeout before start"), { code: "ETIMEOUT" });
+    }
     // 1. Open TCP connection to the local service
     const tcpSocket = createConnection({ port, host: "127.0.0.1" });
+    const tcpConnectTimeoutMs = Math.min(CLI_LOCAL_TCP_CONNECT_TIMEOUT_MS, Math.max(250, getRemainingSetupMs()));
     await new Promise((resolve, reject) => {
         const timeout = setTimeout(() => {
             tcpSocket.destroy();
             reject(Object.assign(new Error(`TCP connect timeout to localhost:${port}`), { code: "ETIMEOUT" }));
-        }, 5000);
+        }, tcpConnectTimeoutMs);
         tcpSocket.on("connect", () => {
             clearTimeout(timeout);
             resolve();
@@ -1697,25 +1788,74 @@ async function handleProxyConnect(payload) {
         ? `password=${encodeURIComponent(currentSessionPassword)}`
         : `code=${encodeURIComponent(currentSessionCode)}`;
     const proxyWsUrl = `${wsBase}/v1/ws/proxy?${authQuery}&tunnelId=${encodeURIComponent(tunnelId)}&role=cli`;
-    const proxyWs = new WebSocket(proxyWsUrl);
-    await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-            proxyWs.close();
+    let proxyWs = null;
+    let lastProxyError = null;
+    for (let attempt = 0; attempt <= PROXY_WS_CONNECT_RETRY_ATTEMPTS; attempt++) {
+        const remainingMs = getRemainingSetupMs();
+        if (remainingMs <= 0) {
             tcpSocket.destroy();
-            reject(Object.assign(new Error("Proxy WS connect timeout"), { code: "ETIMEOUT" }));
-        }, 5000);
-        proxyWs.on("open", () => {
-            clearTimeout(timeout);
-            resolve();
-        });
-        proxyWs.on("error", (err) => {
-            clearTimeout(timeout);
-            tcpSocket.destroy();
-            reject(Object.assign(new Error(`Proxy WS failed: ${err.message}`), { code: "ECONNREFUSED" }));
-        });
-    });
+            throw Object.assign(new Error("Tunnel setup timeout while connecting proxy WS"), { code: "ETIMEOUT" });
+        }
+        const wsConnectTimeoutMs = Math.min(PROXY_WS_CONNECT_TIMEOUT_MS, Math.max(250, remainingMs));
+        const candidateWs = new WebSocket(proxyWsUrl);
+        try {
+            await new Promise((resolve, reject) => {
+                const timeout = setTimeout(() => {
+                    candidateWs.close();
+                    reject(Object.assign(new Error("Proxy WS connect timeout"), { code: "ETIMEOUT" }));
+                }, wsConnectTimeoutMs);
+                candidateWs.on("open", () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+                candidateWs.on("error", (err) => {
+                    clearTimeout(timeout);
+                    reject(Object.assign(new Error(`Proxy WS failed: ${err.message}`), { code: "ECONNREFUSED" }));
+                });
+                candidateWs.on("close", () => {
+                    clearTimeout(timeout);
+                    reject(Object.assign(new Error("Proxy WS closed during connect"), { code: "ECONNRESET" }));
+                });
+            });
+            proxyWs = candidateWs;
+            break;
+        }
+        catch (error) {
+            lastProxyError = error;
+            try {
+                candidateWs.close();
+            }
+            catch {
+                // ignore
+            }
+            if (attempt >= PROXY_WS_CONNECT_RETRY_ATTEMPTS) {
+                break;
+            }
+            const jitterSpan = PROXY_WS_RETRY_JITTER_MAX_MS - PROXY_WS_RETRY_JITTER_MIN_MS;
+            const jitterMs = PROXY_WS_RETRY_JITTER_MIN_MS + Math.floor(Math.random() * (jitterSpan + 1));
+            if (getRemainingSetupMs() <= jitterMs) {
+                break;
+            }
+            await new Promise((resolve) => setTimeout(resolve, jitterMs));
+        }
+    }
+    if (!proxyWs) {
+        tcpSocket.destroy();
+        const err = lastProxyError || Object.assign(new Error("Proxy WS connect failed"), { code: "ECONNREFUSED" });
+        throw err;
+    }
     // 3. Store the tunnel
-    activeTunnels.set(tunnelId, { tunnelId, port, tcpSocket, proxyWs });
+    activeTunnels.set(tunnelId, {
+        tunnelId,
+        port,
+        tcpSocket,
+        proxyWs,
+        localEnded: false,
+        remoteEnded: false,
+        finSent: false,
+        finalizeTimer: null,
+        closing: false,
+    });
     // 4. Pipe: TCP data -> proxy WS (as binary)
     tcpSocket.on("data", (chunk) => {
         if (proxyWs.readyState === WebSocket.OPEN) {
@@ -1724,18 +1864,70 @@ async function handleProxyConnect(payload) {
     });
     // 5. Pipe: proxy WS -> TCP socket (as binary)
     proxyWs.on("message", (data) => {
+        const control = parseProxyControlFrame(data);
+        if (control) {
+            const tunnel = activeTunnels.get(tunnelId);
+            if (!tunnel || tunnel.closing)
+                return;
+            if (control.action === "fin") {
+                tunnel.remoteEnded = true;
+                if (!tcpSocket.destroyed) {
+                    tcpSocket.end();
+                }
+                maybeFinalizeTunnel(tunnelId);
+            }
+            else {
+                tunnel.closing = true;
+                activeTunnels.delete(tunnelId);
+                if (!tcpSocket.destroyed) {
+                    tcpSocket.destroy();
+                }
+                if (proxyWs.readyState === WebSocket.OPEN || proxyWs.readyState === WebSocket.CONNECTING) {
+                    proxyWs.close();
+                }
+            }
+            return;
+        }
         if (!tcpSocket.destroyed) {
-            tcpSocket.write(data);
+            const chunk = Buffer.isBuffer(data)
+                ? data
+                : typeof data === "string"
+                    ? Buffer.from(data)
+                    : Array.isArray(data)
+                        ? Buffer.concat(data)
+                        : Buffer.from(data);
+            tcpSocket.write(chunk);
         }
     });
-    // 6. Close cascade: TCP closes -> close WS
-    tcpSocket.on("close", () => {
-        activeTunnels.delete(tunnelId);
-        if (proxyWs.readyState === WebSocket.OPEN || proxyWs.readyState === WebSocket.CONNECTING) {
-            proxyWs.close();
+    const markLocalEnded = () => {
+        const tunnel = activeTunnels.get(tunnelId);
+        if (!tunnel || tunnel.closing)
+            return;
+        tunnel.localEnded = true;
+        if (!tunnel.finSent) {
+            tunnel.finSent = true;
+            sendProxyControl(tunnel, "fin");
         }
+        maybeFinalizeTunnel(tunnelId);
+    };
+    // 6. Half-close handling
+    tcpSocket.on("end", () => {
+        markLocalEnded();
+    });
+    tcpSocket.on("close", () => {
+        markLocalEnded();
     });
     tcpSocket.on("error", () => {
+        const tunnel = activeTunnels.get(tunnelId);
+        if (tunnel && !tunnel.finSent) {
+            sendProxyControl(tunnel, "rst", "tcp_error");
+        }
+        if (tunnel) {
+            tunnel.closing = true;
+            if (tunnel.finalizeTimer) {
+                clearTimeout(tunnel.finalizeTimer);
+            }
+        }
         activeTunnels.delete(tunnelId);
         if (proxyWs.readyState === WebSocket.OPEN || proxyWs.readyState === WebSocket.CONNECTING) {
             proxyWs.close();
@@ -1743,12 +1935,26 @@ async function handleProxyConnect(payload) {
     });
     // 7. Close cascade: WS closes -> close TCP
     proxyWs.on("close", () => {
+        const tunnel = activeTunnels.get(tunnelId);
+        if (tunnel) {
+            tunnel.closing = true;
+            if (tunnel.finalizeTimer) {
+                clearTimeout(tunnel.finalizeTimer);
+            }
+        }
         activeTunnels.delete(tunnelId);
         if (!tcpSocket.destroyed) {
             tcpSocket.destroy();
         }
     });
     proxyWs.on("error", () => {
+        const tunnel = activeTunnels.get(tunnelId);
+        if (tunnel) {
+            tunnel.closing = true;
+            if (tunnel.finalizeTimer) {
+                clearTimeout(tunnel.finalizeTimer);
+            }
+        }
         activeTunnels.delete(tunnelId);
         if (!tcpSocket.destroyed) {
             tcpSocket.destroy();
@@ -1758,6 +1964,9 @@ async function handleProxyConnect(payload) {
 }
 function cleanupAllTunnels() {
     for (const [, tunnel] of activeTunnels) {
+        if (tunnel.finalizeTimer) {
+            clearTimeout(tunnel.finalizeTimer);
+        }
         tunnel.tcpSocket.destroy();
         if (tunnel.proxyWs.readyState === WebSocket.OPEN) {
             tunnel.proxyWs.close();
@@ -1784,7 +1993,7 @@ async function processMessage(message) {
     }
     // Validate required fields
     if (!ns || !action) {
-        console.warn("[router] Ignoring message with missing ns/action:", JSON.stringify(message).substring(0, 300));
+        console.warn("[router] Ignoring message with missing ns/action:", redactSensitive(JSON.stringify(message).substring(0, 300)));
         return {
             v: 1,
             id,
@@ -2198,7 +2407,11 @@ async function connectWebSocket() {
                                 return;
                             }
                             if (message.type === "close_connection") {
-                                console.log(`[session] closed by gateway: ${message.reason || "expired"}`);
+                                const reason = message.reason || "expired";
+                                console.log(`[session] closed by gateway: ${reason}`);
+                                if (reason === "session ended from app") {
+                                    console.log("[session] Run `npx lunel-cli` again and scan the new QR code to reconnect.");
+                                }
                                 gracefulShutdown();
                                 return;
                             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lunel-cli",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "author": [
     {
       "name": "Soham Bharambe",