mindwire 0.1.29 → 0.1.32

package/dist/{controller-MNMIJHH5.js → controller-CHJ5MMZS.js}

@@ -1,14 +1,18 @@
-import { readJSON, processStateAlive, currentProcessIdentity, ensureDaemonBinary, SDK_VERSION, computerClient, processIdentity, adoptProcess, writeJSON, directRoutes, ownChild } from './chunk-QPZMGVY7.js';
 import { binaryCacheDirectory, cachedExecutable, verifyReleaseBytes, cacheExecutable, executableChecksum } from './chunk-3FR7BFAW.js';
+import { readJSON, processStateAlive, currentProcessIdentity, ensureDaemonBinary, SDK_VERSION, computerClient, processIdentity, adoptProcess, writeJSON, directRoutes, CONTROLLER_PROTOCOL, ownChild } from './chunk-5X5PAFM7.js';
 import './chunk-T6TD76UA.js';
 import { execFile, execFileSync, spawn } from 'child_process';
-import { randomBytes } from 'crypto';
+import { randomBytes, randomUUID } from 'crypto';
 import * as fs from 'fs/promises';
-import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
-import * as path2 from 'path';
+import { open, rm, readFile, mkdtemp, writeFile } from 'fs/promises';
+import * as path3 from 'path';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
 import { tmpdir } from 'os';
 import { promisify } from 'util';
+import { request } from 'https';
+import { lookup } from 'dns';
+import { Resolver } from 'dns/promises';
+import WebSocket from 'ws';
 
 var CLOUDFLARED_VERSION = "2026.9.3";
 var execute = promisify(execFile);
@@ -19,7 +23,7 @@ async function ensureCloudflareBinary(options = {}) {
     throw new Error("Install cloudflared for this computer, or select another connection provider.");
   }
   const asset = `cloudflared-${platform === "win32" ? "windows" : platform}-${cpu}${platform === "darwin" ? ".tgz" : platform === "win32" ? ".exe" : ""}`;
-  const bin = path2.join(
+  const bin = path3.join(
     options.cacheDir ?? await binaryCacheDirectory(),
     "cloudflared",
     CLOUDFLARED_VERSION,
@@ -29,8 +33,8 @@ async function ensureCloudflareBinary(options = {}) {
   const cached = await cachedExecutable(bin);
   if (cached) return cached;
   await options.onProgress?.("Downloading the secure connection helper\u2026");
-  const request = options.fetch ?? fetch;
-  const release = await request(
+  const request2 = options.fetch ?? fetch;
+  const release = await request2(
     `https://api.github.com/repos/cloudflare/cloudflared/releases/tags/${CLOUDFLARED_VERSION}`,
     { headers: { Accept: "application/vnd.github+json" }, signal: AbortSignal.timeout(2e4) }
   );
@@ -40,15 +44,15 @@ async function ensureCloudflareBinary(options = {}) {
   const checksum = item?.digest?.match(/^sha256:([a-f0-9]{64})$/i)?.[1];
   const expectedURL = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${asset}`;
   if (!checksum || item?.browser_download_url !== expectedURL) throw new Error("The connection helper has no verified release asset for this computer.");
-  const downloaded = await request(expectedURL, { signal: AbortSignal.timeout(12e4) });
+  const downloaded = await request2(expectedURL, { signal: AbortSignal.timeout(12e4) });
   if (!downloaded.ok) throw new Error("Couldn't download the connection helper. Check your internet connection and retry.");
   const archive = new Uint8Array(await downloaded.arrayBuffer());
   await verifyReleaseBytes(archive, checksum, asset);
   let executable = archive;
   if (platform === "darwin") {
-    const temporary = await mkdtemp(path2.join(tmpdir(), "mindwire-cloudflared-"));
+    const temporary = await mkdtemp(path3.join(tmpdir(), "mindwire-cloudflared-"));
     try {
-      const archivePath = path2.join(temporary, asset);
+      const archivePath = path3.join(temporary, asset);
       await writeFile(archivePath, archive, { mode: 384 });
       const result = await execute(
         "/usr/bin/tar",
@@ -71,8 +75,70 @@ async function cloudflareCommand(options) {
     return ensureCloudflareBinary(options);
   }
 }
+var RelayOutput = class _RelayOutput {
+  constructor(file, handle) {
+    this.file = file;
+    this.handle = handle;
+  }
+  file;
+  handle;
+  position = 0;
+  timer;
+  pending = Promise.resolve();
+  closing;
+  static async create(directory = tmpdir()) {
+    const file = path3.join(directory, `.relay-output-${randomUUID()}.log`);
+    return new _RelayOutput(file, await open(file, "ax+", 384));
+  }
+  static async adopt(directory, file) {
+    if (path3.dirname(file) !== path3.resolve(directory) || !/^\.relay-output-[a-f0-9-]{36}\.log$/.test(path3.basename(file))) return;
+    try {
+      const output = new _RelayOutput(file, await open(file, "r+"));
+      output.discard();
+      return output;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  get fd() {
+    return this.handle.fd;
+  }
+  async read() {
+    const { size } = await this.handle.stat();
+    if (size > 2 * 1024 * 1024) throw new Error("The tunnel helper produced too much startup output. Check its configuration.");
+    const data = Buffer.alloc(Math.min(65536, Math.max(0, size - this.position)));
+    const { bytesRead } = await this.handle.read(data, 0, data.length, this.position);
+    this.position += bytesRead;
+    return data.subarray(0, bytesRead);
+  }
+  discard() {
+    if (this.timer || this.closing) return;
+    const drain = () => {
+      this.pending = this.pending.then(() => this.handle.truncate(0)).catch(() => {
+      });
+    };
+    drain();
+    this.timer = setInterval(drain, 2e3);
+    this.timer.unref();
+  }
+  close() {
+    return this.closing ??= (async () => {
+      clearInterval(this.timer);
+      await this.pending;
+      await this.handle.close();
+      await rm(this.file, { force: true });
+    })();
+  }
+};
 
 // src/computer/relay.ts
+async function adoptRelay(owner, route, directory, outputFile) {
+  const output = outputFile ? await RelayOutput.adopt(directory, outputFile) : void 0;
+  return { route, owner, outputFile: output?.file, async close() {
+    await owner.close();
+    await output?.close();
+  } };
+}
 function websocketURL(value) {
   const url = new URL(value);
   if (url.protocol === "https:") url.protocol = "wss:";
@@ -114,83 +180,166 @@ async function startRelay(options, port, runtime = {}) {
     }
   }
   runtime.signal?.throwIfAborted();
-  const child = spawn(command, args, { env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-  let buffer = "";
+  const output = await RelayOutput.create(runtime.outputDirectory);
+  const child = spawn(command, args, { env, detached: true, stdio: ["ignore", output.fd, output.fd], windowsHide: true });
+  let failure;
+  child.on("error", (error) => {
+    failure = error;
+  });
+  let owner;
   try {
-    const address = new Promise((resolve2, reject) => {
-      const timer = setTimeout(() => {
-        cleanup();
-        reject(new Error(`${command} did not establish its tunnel. Check its account and tunnel configuration.`));
-      }, 45e3);
-      const cleanup = () => {
-        clearTimeout(timer);
-        child.off("error", fail);
-        child.off("exit", exited);
-        runtime.signal?.removeEventListener("abort", aborted);
-      };
-      const fail = (error) => {
-        cleanup();
-        reject(new Error(`Could not run ${command}. Install it on the computer first.`, { cause: error }));
-      };
-      const exited = () => {
-        cleanup();
-        reject(new Error(`${command} exited before the tunnel connected. Check its account configuration.`));
-      };
-      const aborted = () => {
-        cleanup();
-        child.kill();
-        reject(runtime.signal?.reason ?? new Error("Tunnel startup cancelled."));
-      };
-      let cloudflareAddress = options.url;
-      let cloudflareConnected = false;
-      const receive = (chunk) => {
-        const received = buffer + chunk.toString();
-        buffer = received.slice(-16384);
-        let found;
-        if (options.kind === "cloudflare") {
-          cloudflareAddress ??= received.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/)?.[0];
-          cloudflareConnected ||= /Registered tunnel connection/.test(received);
-          if (cloudflareConnected) found = cloudflareAddress;
-        } else {
-          for (const line of received.split(/\r?\n/)) {
-            try {
-              const event = JSON.parse(line);
-              if (event.msg === "started tunnel" && event.url?.startsWith("https://")) found = event.url;
-            } catch {
-            }
+    await new Promise((resolve3, reject) => {
+      child.once("spawn", resolve3);
+      child.once("error", reject);
+    });
+    owner = await ownChild(child);
+    await runtime.onSpawn?.(owner, output.file);
+    const deadline = Date.now() + 45e3;
+    let buffer = "", cloudflareAddress = options.url, cloudflareConnected = false;
+    while (Date.now() < deadline) {
+      runtime.signal?.throwIfAborted();
+      if (failure) throw new Error(`Could not run ${options.kind}. Check its installation.`, { cause: failure });
+      if (!owner.alive()) throw new Error(`${options.kind} exited before the tunnel connected. Check its account configuration.`);
+      const received = buffer + (await output.read()).toString();
+      buffer = received.slice(-16384);
+      let found;
+      if (options.kind === "cloudflare") {
+        cloudflareAddress ??= received.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/)?.[0];
+        cloudflareConnected ||= /Registered tunnel connection/.test(received);
+        if (cloudflareConnected) found = cloudflareAddress;
+      } else {
+        for (const line of received.split(/\r?\n/)) {
+          try {
+            const event = JSON.parse(line);
+            if (event.msg === "started tunnel" && event.url?.startsWith("https://")) found = event.url;
+          } catch {
           }
         }
-        if (found) {
-          cleanup();
-          resolve2(websocketURL(found));
-        }
-      };
-      child.once("error", fail);
-      child.once("exit", exited);
-      child.stdout.on("data", receive);
-      child.stderr.on("data", receive);
-      runtime.signal?.addEventListener("abort", aborted, { once: true });
-      if (runtime.signal?.aborted) aborted();
+      }
+      if (found) {
+        const route = { kind: "websocket", url: websocketURL(found) };
+        output.discard();
+        const provider = owner;
+        return {
+          route,
+          process: child,
+          owner,
+          outputFile: output.file,
+          async close() {
+            await provider.close();
+            await output.close();
+          }
+        };
+      }
+      await setTimeout$1(50, void 0, { signal: runtime.signal });
+    }
+    throw new Error(`${options.kind} did not establish its tunnel. Check your internet connection and its configuration.`);
+  } catch (error) {
+    if (owner) await owner.close();
+    else if (child.pid) await (await ownChild(child)).close();
+    await output.close();
+    throw error;
+  }
+}
+var RelayCheckError = class extends Error {
+  constructor(code, message, cause) {
+    super(message, cause ? { cause } : void 0);
+    this.code = code;
+    this.name = "RelayCheckError";
+  }
+  code;
+};
+function relayNeedsRestart(error, failures, failedForMs) {
+  return failures >= 2 && failedForMs >= 9e4 && !(error instanceof RelayCheckError && error.code === "dns");
+}
+var relayLookup = (hostname, options, callback) => {
+  lookup(hostname, options, (error, address, family) => {
+    if (error?.code !== "ENOTFOUND" || !/^[a-z0-9-]+\.trycloudflare\.com$/i.test(hostname)) {
+      callback(error, address, family);
+      return;
+    }
+    const resolver = new Resolver({ timeout: 3e3, tries: 1 });
+    void Promise.all([
+      options.family === 6 ? [] : resolver.resolve4(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 4 })), () => []),
+      options.family === 4 ? [] : resolver.resolve6(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 6 })), () => [])
+    ]).then((results) => {
+      const addresses = results.flat();
+      if (!addresses.length) {
+        callback(error, address, family);
+        return;
+      }
+      if (options.all) callback(null, addresses);
+      else callback(null, addresses[0].address, addresses[0].family);
     });
-    void address.catch(() => {
+  });
+};
+async function checkRelay(route, options = {}) {
+  options.signal?.throwIfAborted();
+  if (route.kind !== "websocket") throw new Error("Expected an internet tunnel address.");
+  await new Promise((resolve3, reject) => {
+    const socket = new WebSocket(route.url, { maxPayload: 4096, perMessageDeflate: false, followRedirects: false, lookup: options.lookup ?? relayLookup });
+    let finished = false, banner = "";
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", aborted);
+      socket.terminate();
+      if (error) reject(error);
+      else resolve3();
+    };
+    const aborted = () => finish(options.signal?.reason ?? new Error("Connection check cancelled."));
+    const timer = setTimeout(() => finish(new RelayCheckError("timeout", "The internet tunnel isn't responding. Retrying\u2026")), options.timeoutMs ?? 8e3);
+    socket.on("error", (error) => {
+      if (["ENOTFOUND", "EAI_AGAIN"].includes(error.code ?? "")) {
+        const provider = new URL(route.url).hostname.endsWith(".trycloudflare.com") ? "Cloudflare's" : "the tunnel's";
+        finish(new RelayCheckError("dns", `Waiting for ${provider} internet address (DNS)\u2026`, error));
+      } else if (/(?:[Uu]nexpected server response|[Ee]xpected 101)/.test(error.message)) {
+        finish(new RelayCheckError("proxy", "The internet tunnel isn't reaching Mindwire. Retrying\u2026", error));
+      } else {
+        finish(new RelayCheckError("connection", "The internet tunnel couldn't connect. Retrying\u2026", error));
+      }
     });
-    const owner = await ownChild(child);
-    await runtime.onSpawn?.(owner);
-    const url = await address;
-    runtime.signal?.throwIfAborted();
-    child.stdout.removeAllListeners("data");
-    child.stderr.removeAllListeners("data");
-    child.stdout.resume();
-    child.stderr.resume();
-    child.on("error", () => {
+    socket.on("close", () => finish(new RelayCheckError("connection", "The internet tunnel closed before reaching Mindwire. Retrying\u2026")));
+    socket.on("message", (data, binary) => {
+      if (!binary) {
+        finish(new RelayCheckError("response", "The internet tunnel returned an invalid SSH response."));
+        return;
+      }
+      banner += data.toString();
+      if (banner.length > 1024) {
+        finish(new RelayCheckError("response", "The internet tunnel returned an invalid SSH response."));
+        return;
+      }
+      if (banner.includes("\n")) {
+        finish(banner.split("\n")[0]?.trim() === "SSH-2.0-Mindwire" ? void 0 : new RelayCheckError("response", "The internet tunnel isn't connected to the Mindwire SSH service."));
+      }
     });
-    return { route: { kind: "websocket", url }, process: child, owner, close: () => owner.close() };
-  } catch (error) {
-    child.on("error", () => {
+    options.signal?.addEventListener("abort", aborted, { once: true });
+    if (options.signal?.aborted) aborted();
+  });
+}
+async function relayProviderReachable(options, signal) {
+  if (options.kind !== "cloudflare" && options.kind !== "ngrok") return false;
+  signal?.throwIfAborted();
+  return new Promise((resolve3) => {
+    const url = options.kind === "cloudflare" ? "https://api.trycloudflare.com/" : "https://api.ngrok.com/";
+    let finished = false;
+    const done = (reachable) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      probe.destroy();
+      resolve3(reachable);
+    };
+    const probe = request(url, { method: "HEAD", signal }, (response) => {
+      response.destroy();
+      done(true);
     });
-    if (child.pid) await (await ownChild(child)).close();
-    throw error;
-  }
+    const timer = setTimeout(() => done(false), 5e3);
+    probe.on("error", () => done(false));
+    probe.end();
+  });
 }
 
 // src/computer/controller.ts
@@ -198,19 +347,21 @@ function recoveryDelay(failures) {
   return Math.min(6e4, 1e3 * 2 ** Math.min(6, Math.max(0, failures - 1)));
 }
 async function superviseComputer(directory) {
-  if ((await readJSON(path2.join(directory, "computer-stopped.json")))?.stopped) return;
-  let config = await readJSON(path2.join(directory, "computer-config.json"));
+  if ((await readJSON(path3.join(directory, "computer-stopped.json")))?.stopped) return;
+  let config = await readJSON(path3.join(directory, "computer-config.json"));
   if (!config) throw new Error("Computer configuration is missing.");
-  const controllerPath = path2.join(directory, "computer-controller.json");
-  const relayPath = path2.join(directory, "computer-relay.json");
+  const controllerPath = path3.join(directory, "computer-controller.json");
+  const relayPath = path3.join(directory, "computer-relay.json");
   const previous = await readJSON(controllerPath);
   if (await processStateAlive(previous)) throw new Error("The computer already has a service controller.");
   const owner = await currentProcessIdentity();
-  const phase = (message) => writeJSON(controllerPath, { ...owner, ready: false, phase: message, recovering: true });
+  const phase = (message) => writeJSON(controllerPath, { ...owner, protocol: CONTROLLER_PROTOCOL, cliVersion: SDK_VERSION, ready: false, phase: message, recovering: true });
   await phase("Preparing Mindwire\u2026");
   let child, relay, stopping = false;
   let relayTask, updateTask;
   let relayResult;
+  let checkTask;
+  let checkResult;
   const abort = new AbortController();
   const stop = () => {
     stopping = true;
@@ -220,30 +371,30 @@ async function superviseComputer(directory) {
   process.on("SIGINT", stop);
   let token;
   try {
-    token = (await fs.readFile(path2.join(directory, "daemon.token"), "utf8")).trim();
+    token = (await fs.readFile(path3.join(directory, "daemon.token"), "utf8")).trim();
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
     token = randomBytes(32).toString("hex");
-    await fs.writeFile(path2.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
+    await fs.writeFile(path3.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
   }
   const daemonEnv = { ...process.env };
   if (process.platform === "win32") {
     try {
       const git = execFileSync("where.exe", ["git"], { encoding: "utf8", timeout: 3e3, windowsHide: true }).split(/\r?\n/)[0];
       if (git) {
-        const shellDirectory = path2.resolve(path2.dirname(git), "..", "bin");
-        await fs.access(path2.join(shellDirectory, "bash.exe"));
+        const shellDirectory = path3.resolve(path3.dirname(git), "..", "bin");
+        await fs.access(path3.join(shellDirectory, "bash.exe"));
         const pathKey = Object.keys(daemonEnv).find((key) => key.toLowerCase() === "path") ?? "PATH";
-        daemonEnv[pathKey] = `${shellDirectory}${path2.delimiter}${daemonEnv[pathKey] ?? ""}`;
+        daemonEnv[pathKey] = `${shellDirectory}${path3.delimiter}${daemonEnv[pathKey] ?? ""}`;
       }
     } catch {
     }
   }
-  const oldRuntime = await readJSON(path2.join(directory, "computer-runtime.json"));
+  const oldRuntime = await readJSON(path3.join(directory, "computer-runtime.json"));
   let sshPort = config.sshPort || oldRuntime?.sshPort || 0;
   let websocketPort = config.websocketPort || oldRuntime?.websocketPort || 0;
   const launch = async (binary) => {
-    await fs.rm(path2.join(directory, "computer-runtime.json"), { force: true });
+    await fs.rm(path3.join(directory, "computer-runtime.json"), { force: true });
     const process2 = spawn(binary, ["--computer"], {
       cwd: config.directory,
       stdio: ["ignore", "inherit", "inherit"],
@@ -252,8 +403,8 @@ async function superviseComputer(directory) {
         ...daemonEnv,
         DAEMON_TOKEN: token,
         ADDR: "127.0.0.1:0",
-        STATE_PATH: path2.join(directory, "agent-state.json"),
-        WORKSPACE_DB_PATH: path2.join(directory, "workspace.db"),
+        STATE_PATH: path3.join(directory, "agent-state.json"),
+        WORKSPACE_DB_PATH: path3.join(directory, "workspace.db"),
         AGENT_CWD: config.directory,
         COMPUTER_SSH_ADDR: `${config.bind.includes(":") ? `[${config.bind}]` : config.bind}:${sshPort}`,
         COMPUTER_WS_ADDR: `127.0.0.1:${websocketPort}`,
@@ -264,8 +415,8 @@ async function superviseComputer(directory) {
     process2.on("error", (error) => {
       failure = error;
     });
-    await new Promise((resolve2, reject) => {
-      process2.once("spawn", resolve2);
+    await new Promise((resolve3, reject) => {
+      process2.once("spawn", resolve3);
       process2.once("error", reject);
     });
     child = await ownChild(process2);
@@ -292,9 +443,13 @@ async function superviseComputer(directory) {
   let routes = [], published = "";
   let client;
   let relayMessage = "Preparing your internet connection\u2026", relayError;
+  let relayErrorCode;
   let daemonError, nextDaemonAt = 0, daemonFailures = 0;
   let nextRelayAt = 0, relayFailures = 0, changingDaemon = false;
   let daemonReadyAt = Date.now(), relayReadyAt = Date.now();
+  let relayReachable = false, relayWasReachable = false, relayHealthFailures = 0;
+  let relayFailedAt = 0;
+  let nextCheckAt = 0, checkedAt = 0;
   try {
     await phase("Checking the Mindwire service\u2026");
     let binary = config.daemonBin ?? await ensureDaemonBinary({ version: config.version ?? SDK_VERSION, cacheDir: process.env.MINDWIRE_RELEASE_CACHE_DIR });
@@ -317,11 +472,16 @@ async function superviseComputer(directory) {
     if (saved) {
       const owner2 = await adoptProcess(saved.owner);
       if (owner2) {
-        if (saved.route && saved.port === websocketPort && saved.options === JSON.stringify(config.relay)) {
-          relay = { route: saved.route, owner: owner2, close: () => owner2.close() };
+        if (saved.outputFile && saved.route && saved.port === websocketPort && saved.options === JSON.stringify(config.relay)) {
+          relay = await adoptRelay(owner2, saved.route, directory, saved.outputFile);
         } else {
-          await owner2.close();
+          if (!saved.outputFile) await phase("Refreshing the internet tunnel for this update\u2026");
+          const abandoned = await adoptRelay(owner2, saved.route, directory, saved.outputFile);
+          await abandoned.close();
+          await fs.rm(relayPath, { force: true });
         }
+      } else if (saved.outputFile) {
+        await (await RelayOutput.adopt(directory, saved.outputFile))?.close();
       }
     }
     let lastController = "";
@@ -333,7 +493,7 @@ async function superviseComputer(directory) {
         nextDaemonAt = Date.now() + recoveryDelay(++daemonFailures);
       }
       if (child?.alive() && Date.now() - daemonReadyAt > 6e4) daemonFailures = 0;
-      if (relay?.owner?.alive() && Date.now() - relayReadyAt > 6e4) relayFailures = 0;
+      if (relayReachable && relay?.owner?.alive() && Date.now() - relayReadyAt > 6e4) relayFailures = 0;
       if (!changingDaemon && !child?.alive() && Date.now() >= nextDaemonAt) {
         daemonError = "The service stopped. Restarting it\u2026";
         await phase(daemonError);
@@ -351,7 +511,11 @@ async function superviseComputer(directory) {
         }
       }
       if (relay?.owner && !relay.owner.alive()) {
+        await relay.close();
         relay = void 0;
+        relayReachable = false;
+        relayWasReachable = false;
+        relayErrorCode = void 0;
         relayError = "The internet tunnel disconnected. Reconnecting\u2026";
         nextRelayAt = Date.now() + recoveryDelay(++relayFailures);
       }
@@ -362,12 +526,19 @@ async function superviseComputer(directory) {
         if (result.handle) {
           relay = result.handle;
           relayError = void 0;
+          relayErrorCode = void 0;
           relayReadyAt = Date.now();
+          relayReachable = false;
+          relayWasReachable = false;
+          relayHealthFailures = 0;
+          relayFailedAt = 0;
+          nextCheckAt = 0;
           if (relay.owner?.identity) await writeJSON(relayPath, {
             owner: relay.owner.identity,
             port: websocketPort,
             options: JSON.stringify(config.relay),
-            route: relay.route
+            route: relay.route,
+            outputFile: relay.outputFile
           });
         } else {
           relayError = result.error instanceof Error ? result.error.message : "The internet tunnel couldn't connect.";
@@ -375,18 +546,22 @@ async function superviseComputer(directory) {
         }
       }
       if (!relay && !relayTask && Date.now() >= nextRelayAt) {
+        relayError = void 0;
+        relayErrorCode = void 0;
         relayMessage = "Reconnecting your internet tunnel\u2026";
         relayTask = startRelay(config.relay, websocketPort, {
-          cacheDir: path2.join(directory, "tools"),
+          cacheDir: path3.join(directory, "tools"),
+          outputDirectory: directory,
           signal: abort.signal,
           onProgress: (message) => {
             relayMessage = message;
           },
-          onSpawn: async (owner2) => {
+          onSpawn: async (owner2, outputFile) => {
             if (owner2.identity) await writeJSON(relayPath, {
               owner: owner2.identity,
               port: websocketPort,
-              options: JSON.stringify(config.relay)
+              options: JSON.stringify(config.relay),
+              outputFile
             });
           }
         }).then((handle) => {
@@ -395,8 +570,52 @@ async function superviseComputer(directory) {
           relayResult = { error };
         });
       }
+      if (checkResult) {
+        const result = checkResult;
+        checkResult = void 0;
+        checkTask = void 0;
+        if (result.relay === relay) {
+          checkedAt = Date.now();
+          relayReachable = !result.error;
+          if (!result.error) {
+            relayWasReachable = true;
+            relayHealthFailures = 0;
+            relayFailedAt = 0;
+            relayError = void 0;
+            relayErrorCode = void 0;
+            nextCheckAt = checkedAt + 3e4;
+          } else {
+            relayError = result.error instanceof Error ? result.error.message : "The internet tunnel couldn't connect. Retrying\u2026";
+            relayErrorCode = result.error instanceof RelayCheckError ? result.error.code : void 0;
+            relayFailedAt ||= checkedAt;
+            relayHealthFailures++;
+            nextCheckAt = checkedAt + Math.min(15e3, recoveryDelay(relayHealthFailures));
+            if (result.canRestart) {
+              await relay.close();
+              relay = void 0;
+              relayWasReachable = false;
+              nextRelayAt = Date.now() + recoveryDelay(++relayFailures);
+              await fs.rm(relayPath, { force: true });
+            }
+          }
+        }
+      }
+      const requestedCheck = await readJSON(path3.join(directory, "computer-check.json"));
+      if (config.relay.kind === "none") checkedAt = Math.max(checkedAt, requestedCheck?.requestedAt ?? 0);
+      if (relay?.route && !checkTask && (Date.now() >= nextCheckAt || (requestedCheck?.requestedAt ?? 0) > checkedAt)) {
+        const checking = relay;
+        checkTask = (async () => {
+          try {
+            await checkRelay(checking.route, { signal: abort.signal });
+            checkResult = { relay: checking };
+          } catch (error) {
+            const canRestart = !!checking.owner && relayFailedAt > 0 && relayNeedsRestart(error, relayHealthFailures, Date.now() - relayFailedAt) && await relayProviderReachable(config.relay, abort.signal).catch(() => false);
+            checkResult = { relay: checking, error, canRestart };
+          }
+        })();
+      }
       routes = directRoutes(config, sshPort);
-      if (relay?.route) routes.push(relay.route);
+      if (relay?.route && relayWasReachable) routes.push(relay.route);
       const routeJSON = JSON.stringify(routes);
       if (!changingDaemon && client && child?.alive() && routeJSON !== published) {
         try {
@@ -405,13 +624,17 @@ async function superviseComputer(directory) {
         } catch {
         }
       }
-      const ready = !!client && !!child?.alive() && !changingDaemon && routes.length > 0 && published === routeJSON && (config.relay.kind === "none" || !!relay?.route);
+      const ready = !!client && !!child?.alive() && !changingDaemon && routes.length > 0 && published === routeJSON && (config.relay.kind === "none" || relayReachable);
       const state = {
         ...owner,
+        protocol: CONTROLLER_PROTOCOL,
+        cliVersion: SDK_VERSION,
         ready,
         routes,
-        phase: ready ? void 0 : daemonError ?? relayMessage,
+        checkedAt,
+        phase: ready ? void 0 : daemonError ?? relayError ?? relayMessage,
         error: daemonError ?? relayError,
+        errorCode: daemonError ? void 0 : relayErrorCode,
         recovering: !ready
       };
       const serialized = JSON.stringify(state);
@@ -419,7 +642,7 @@ async function superviseComputer(directory) {
         await writeJSON(controllerPath, state);
         lastController = serialized;
       }
-      const updatePath = path2.join(directory, "computer-update.json");
+      const updatePath = path3.join(directory, "computer-update.json");
       const update = !updateTask && client && child?.alive() ? await readJSON(updatePath) : void 0;
       if (update && ["queued", "downloading", "waiting", "restarting"].includes(update.status)) {
         updateTask = (async () => {
@@ -459,7 +682,7 @@ async function superviseComputer(directory) {
             }
             binary = replacement;
             config = { ...config, daemonBin: void 0, version: update.version };
-            await writeJSON(path2.join(directory, "computer-config.json"), config);
+            await writeJSON(path3.join(directory, "computer-config.json"), config);
             await client.computer.setRoutes(routes);
             published = JSON.stringify(routes);
             await status("complete");
@@ -481,6 +704,7 @@ async function superviseComputer(directory) {
   } finally {
     abort.abort();
     await relayTask;
+    await checkTask;
     await updateTask;
     if (relayResult?.handle && relayResult.handle !== relay) await relayResult.handle.close();
     await relay?.close();
@@ -492,5 +716,5 @@ async function superviseComputer(directory) {
 }
 
 export { recoveryDelay, superviseComputer };
-//# sourceMappingURL=controller-MNMIJHH5.js.map
-//# sourceMappingURL=controller-MNMIJHH5.js.map
+//# sourceMappingURL=controller-CHJ5MMZS.js.map
+//# sourceMappingURL=controller-CHJ5MMZS.js.map