mindwire 0.1.33 → 0.1.36

package/dist/{controller-QBC6L7AT.js → controller-2SJLZMJZ.js}

@@ -1,272 +1,102 @@
-import { binaryCacheDirectory, cachedExecutable, verifyReleaseBytes, cacheExecutable, executableChecksum } from './chunk-3FR7BFAW.js';
-import { readJSON, processStateAlive, currentProcessIdentity, ensureDaemonBinary, SDK_VERSION, computerClient, processIdentity, adoptProcess, writeJSON, directRoutes, CONTROLLER_PROTOCOL, ownChild } from './chunk-H2I3VRBS.js';
-import './chunk-T6TD76UA.js';
-import { execFile, execFileSync, spawn } from 'child_process';
-import { randomBytes, randomUUID } from 'crypto';
+import { connectionInfo } from './chunk-67BNDGRK.js';
+import { readJSON, processStateAlive, currentProcessIdentity, ensureDaemonBinary, SDK_VERSION, computerClient, processIdentity, adoptProcess, adoptRelay, RelayOutput, writeJSON, startRelay, providerNeedsAction, directRoutes, ProviderConnectionError, CONTROLLER_PROTOCOL, ownChild, hasCertificateError } from './chunk-RTGZDLSG.js';
+import './chunk-PFYKJ6LX.js';
+import { execFileSync, spawn } from 'child_process';
+import { randomBytes } from 'crypto';
 import * as fs from 'fs/promises';
-import { open, rm, readFile, mkdtemp, writeFile } from 'fs/promises';
-import * as path3 from 'path';
+import * as path from 'path';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
-import { tmpdir } from 'os';
-import { promisify } from 'util';
 import { request } from 'https';
 import { lookup } from 'dns';
 import { Resolver } from 'dns/promises';
+import { isIP } from 'net';
 import WebSocket from 'ws';
 
-var CLOUDFLARED_VERSION = "2026.9.3";
-var execute = promisify(execFile);
-async function ensureCloudflareBinary(options = {}) {
-  const platform = options.platform ?? process.platform, arch = options.arch ?? process.arch;
-  const cpu = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : "";
-  if (!cpu || !["darwin", "linux", "win32"].includes(platform) || platform === "win32" && cpu !== "amd64") {
-    throw new Error("Install cloudflared for this computer, or select another connection provider.");
-  }
-  const asset = `cloudflared-${platform === "win32" ? "windows" : platform}-${cpu}${platform === "darwin" ? ".tgz" : platform === "win32" ? ".exe" : ""}`;
-  const bin = path3.join(
-    options.cacheDir ?? await binaryCacheDirectory(),
-    "cloudflared",
-    CLOUDFLARED_VERSION,
-    `${platform}-${arch}`,
-    platform === "win32" ? "cloudflared.exe" : "cloudflared"
-  );
-  const cached = await cachedExecutable(bin);
-  if (cached) return cached;
-  await options.onProgress?.("Downloading the secure connection helper\u2026");
-  const request2 = options.fetch ?? fetch;
-  const release = await request2(
-    `https://api.github.com/repos/cloudflare/cloudflared/releases/tags/${CLOUDFLARED_VERSION}`,
-    { headers: { Accept: "application/vnd.github+json" }, signal: AbortSignal.timeout(2e4) }
-  );
-  if (!release.ok) throw new Error("Couldn't download the connection helper. Retry, install cloudflared yourself, or choose another provider.");
-  const metadata = await release.json();
-  const item = metadata.assets?.find((value) => value.name === asset);
-  const checksum = item?.digest?.match(/^sha256:([a-f0-9]{64})$/i)?.[1];
-  const expectedURL = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${asset}`;
-  if (!checksum || item?.browser_download_url !== expectedURL) throw new Error("The connection helper has no verified release asset for this computer.");
-  const downloaded = await request2(expectedURL, { signal: AbortSignal.timeout(12e4) });
-  if (!downloaded.ok) throw new Error("Couldn't download the connection helper. Check your internet connection and retry.");
-  const archive = new Uint8Array(await downloaded.arrayBuffer());
-  await verifyReleaseBytes(archive, checksum, asset);
-  let executable = archive;
-  if (platform === "darwin") {
-    const temporary = await mkdtemp(path3.join(tmpdir(), "mindwire-cloudflared-"));
-    try {
-      const archivePath = path3.join(temporary, asset);
-      await writeFile(archivePath, archive, { mode: 384 });
-      const result = await execute(
-        "/usr/bin/tar",
-        ["-xzOf", archivePath, "cloudflared"],
-        { encoding: "buffer", maxBuffer: 128 * 1024 * 1024, timeout: 3e4 }
-      );
-      executable = new Uint8Array(result.stdout);
-    } finally {
-      await rm(temporary, { recursive: true, force: true });
-    }
-  }
-  return cacheExecutable(bin, executable, await executableChecksum(executable));
-}
-async function cloudflareCommand(options) {
-  try {
-    await execute("cloudflared", ["--version"], { timeout: 3e3, windowsHide: true });
-    return "cloudflared";
-  } catch (error) {
-    if (error.code !== "ENOENT") throw new Error("The installed cloudflared could not start. Repair it or choose another connection provider.");
-    return ensureCloudflareBinary(options);
-  }
-}
-var RelayOutput = class _RelayOutput {
-  constructor(file, handle) {
-    this.file = file;
-    this.handle = handle;
-  }
-  file;
-  handle;
-  position = 0;
-  timer;
-  pending = Promise.resolve();
-  closing;
-  static async create(directory = tmpdir()) {
-    const file = path3.join(directory, `.relay-output-${randomUUID()}.log`);
-    return new _RelayOutput(file, await open(file, "ax+", 384));
-  }
-  static async adopt(directory, file) {
-    if (path3.dirname(file) !== path3.resolve(directory) || !/^\.relay-output-[a-f0-9-]{36}\.log$/.test(path3.basename(file))) return;
-    try {
-      const output = new _RelayOutput(file, await open(file, "r+"));
-      output.discard();
-      return output;
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-  get fd() {
-    return this.handle.fd;
-  }
-  async read() {
-    const { size } = await this.handle.stat();
-    if (size > 2 * 1024 * 1024) throw new Error("The tunnel helper produced too much startup output. Check its configuration.");
-    const data = Buffer.alloc(Math.min(65536, Math.max(0, size - this.position)));
-    const { bytesRead } = await this.handle.read(data, 0, data.length, this.position);
-    this.position += bytesRead;
-    return data.subarray(0, bytesRead);
-  }
-  discard() {
-    if (this.timer || this.closing) return;
-    const drain = () => {
-      this.pending = this.pending.then(() => this.handle.truncate(0)).catch(() => {
-      });
-    };
-    drain();
-    this.timer = setInterval(drain, 2e3);
-    this.timer.unref();
-  }
-  close() {
-    return this.closing ??= (async () => {
-      clearInterval(this.timer);
-      await this.pending;
-      await this.handle.close();
-      await rm(this.file, { force: true });
-    })();
-  }
-};
-
-// src/computer/relay.ts
-async function adoptRelay(owner, route, directory, outputFile) {
-  const output = outputFile ? await RelayOutput.adopt(directory, outputFile) : void 0;
-  return { route, owner, outputFile: output?.file, async close() {
-    await owner.close();
-    await output?.close();
-  } };
-}
-function websocketURL(value) {
-  const url = new URL(value);
-  if (url.protocol === "https:") url.protocol = "wss:";
-  if (url.protocol !== "wss:" || !url.hostname || url.username || url.password || url.hash) {
-    throw new Error("Relay URLs must use wss:// with no embedded credentials or fragment.");
-  }
-  if (!url.pathname || url.pathname === "/") url.pathname = "/ssh";
-  return url.toString();
-}
-async function startRelay(options, port, runtime = {}) {
-  runtime.signal?.throwIfAborted();
-  if (options.kind === "none") return { close() {
-  } };
-  if (options.kind === "custom") {
-    if (!options.url) throw new Error("A custom relay needs --relay-url wss://your-host/ssh.");
-    return { route: { kind: "websocket", url: websocketURL(options.url) }, close() {
-    } };
-  }
-  const origin = `http://127.0.0.1:${port}`;
-  const env = { ...process.env };
-  let command, args;
-  if (options.kind === "cloudflare") {
-    command = await cloudflareCommand(runtime);
-    await runtime.onProgress?.("Connecting through Cloudflare\u2026");
-    if (options.cloudflareTokenFile) {
-      if (!options.url) throw new Error("A named Cloudflare tunnel needs --relay-url for its configured hostname.");
-      env.TUNNEL_TOKEN = (await readFile(options.cloudflareTokenFile, "utf8")).trim();
-      args = ["tunnel", "--no-autoupdate", "run"];
-    } else {
-      if (options.url) throw new Error("Use --cloudflare-token-file with a named tunnel, or --relay custom for an existing tunnel.");
-      args = ["tunnel", "--no-autoupdate", "--url", origin];
-    }
-  } else {
-    command = "ngrok";
-    args = ["http", origin, "--log", "stdout", "--log-format", "json"];
-    if (options.url) {
-      const url = new URL(websocketURL(options.url));
-      args.push("--url", `https://${url.host}`);
-    }
-  }
-  runtime.signal?.throwIfAborted();
-  const output = await RelayOutput.create(runtime.outputDirectory);
-  const child = spawn(command, args, { env, detached: true, stdio: ["ignore", output.fd, output.fd], windowsHide: true });
-  let failure;
-  child.on("error", (error) => {
-    failure = error;
-  });
-  let owner;
-  try {
-    await new Promise((resolve3, reject) => {
-      child.once("spawn", resolve3);
-      child.once("error", reject);
-    });
-    owner = await ownChild(child);
-    await runtime.onSpawn?.(owner, output.file);
-    const deadline = Date.now() + 45e3;
-    let buffer = "", cloudflareAddress = options.url, cloudflareConnected = false;
-    while (Date.now() < deadline) {
-      runtime.signal?.throwIfAborted();
-      if (failure) throw new Error(`Could not run ${options.kind}. Check its installation.`, { cause: failure });
-      if (!owner.alive()) throw new Error(`${options.kind} exited before the tunnel connected. Check its account configuration.`);
-      const received = buffer + (await output.read()).toString();
-      buffer = received.slice(-16384);
-      let found;
-      if (options.kind === "cloudflare") {
-        cloudflareAddress ??= received.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/)?.[0];
-        cloudflareConnected ||= /Registered tunnel connection/.test(received);
-        if (cloudflareConnected) found = cloudflareAddress;
-      } else {
-        for (const line of received.split(/\r?\n/)) {
-          try {
-            const event = JSON.parse(line);
-            if (event.msg === "started tunnel" && event.url?.startsWith("https://")) found = event.url;
-          } catch {
-          }
-        }
-      }
-      if (found) {
-        const route = { kind: "websocket", url: websocketURL(found) };
-        output.discard();
-        const provider = owner;
-        return {
-          route,
-          process: child,
-          owner,
-          outputFile: output.file,
-          async close() {
-            await provider.close();
-            await output.close();
-          }
-        };
-      }
-      await setTimeout$1(50, void 0, { signal: runtime.signal });
-    }
-    throw new Error(`${options.kind} did not establish its tunnel. Check your internet connection and its configuration.`);
-  } catch (error) {
-    if (owner) await owner.close();
-    else if (child.pid) await (await ownChild(child)).close();
-    await output.close();
-    throw error;
-  }
-}
 var RelayCheckError = class extends Error {
-  constructor(code, message, cause) {
+  constructor(code, message, cause, addressMissing = false) {
     super(message, cause ? { cause } : void 0);
     this.code = code;
+    this.addressMissing = addressMissing;
     this.name = "RelayCheckError";
   }
   code;
+  addressMissing;
 };
 function relayNeedsRestart(error, failures, failedForMs) {
-  return failures >= 2 && failedForMs >= 9e4 && !(error instanceof RelayCheckError && error.code === "dns");
+  return failures >= 2 && failedForMs >= 9e4 && !(error instanceof RelayCheckError && error.code === "provider_certificate") && (!(error instanceof RelayCheckError && error.code === "dns") || error.addressMissing);
+}
+var quickTunnelHost = /^[a-z0-9-]+\.trycloudflare\.com$/i;
+async function resolveCloudflareAddress(hostname, family = 0, options = {}) {
+  if (!quickTunnelHost.test(hostname)) return { addresses: [], missing: false };
+  const abort = new AbortController();
+  const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? 3e3);
+  try {
+    const types = family === 4 ? [1] : family === 6 ? [28] : [1, 28];
+    const results = await Promise.all(types.map(async (type) => {
+      try {
+        const response = await (options.fetch ?? fetch)(
+          `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(hostname)}&type=${type}`,
+          { headers: { accept: "application/dns-json" }, redirect: "error", signal: abort.signal }
+        );
+        if (response.status !== 200 || !response.body) {
+          await response.body?.cancel();
+          return void 0;
+        }
+        const reader = response.body.getReader();
+        let text = "", size = 0;
+        const decoder = new TextDecoder();
+        try {
+          for (; ; ) {
+            const chunk = await reader.read();
+            if (chunk.done) break;
+            size += chunk.value.length;
+            if (size > 16384) return void 0;
+            text += decoder.decode(chunk.value, { stream: true });
+          }
+        } finally {
+          await reader.cancel();
+        }
+        const result = JSON.parse(text + decoder.decode());
+        if (!Array.isArray(result.Question) || !result.Question.some((question) => question.name?.replace(/\.$/, "").toLowerCase() === hostname.toLowerCase() && question.type === type)) return void 0;
+        if (result.Status === 3) return { addresses: [], missing: true };
+        if (result.Status !== 0) return void 0;
+        const addresses = (Array.isArray(result.Answer) ? result.Answer : []).flatMap((answer) => {
+          const family2 = answer.type === 1 ? 4 : answer.type === 28 ? 6 : 0;
+          return family2 && answer.type === type && typeof answer.data === "string" && isIP(answer.data) === family2 ? [{ address: answer.data, family: family2 }] : [];
+        });
+        return { addresses, missing: false };
+      } catch {
+        return void 0;
+      }
+    }));
+    return {
+      addresses: results.flatMap((result) => result?.addresses ?? []),
+      missing: results.every((result) => result?.missing === true)
+    };
+  } finally {
+    clearTimeout(timer);
+  }
 }
 var relayLookup = (hostname, options, callback) => {
   lookup(hostname, options, (error, address, family) => {
-    if (error?.code !== "ENOTFOUND" || !/^[a-z0-9-]+\.trycloudflare\.com$/i.test(hostname)) {
+    if (!["ENOTFOUND", "EAI_AGAIN"].includes(error?.code ?? "") || !quickTunnelHost.test(hostname)) {
       callback(error, address, family);
       return;
     }
     const resolver = new Resolver({ timeout: 3e3, tries: 1 });
+    const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : options.family ?? 0;
     void Promise.all([
-      options.family === 6 ? [] : resolver.resolve4(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 4 })), () => []),
-      options.family === 4 ? [] : resolver.resolve6(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 6 })), () => [])
-    ]).then((results) => {
-      const addresses = results.flat();
+      requestedFamily === 6 ? [] : resolver.resolve4(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 4 })), () => []),
+      requestedFamily === 4 ? [] : resolver.resolve6(hostname).then((addresses) => addresses.map((address2) => ({ address: address2, family: 6 })), () => [])
+    ]).then(async (results) => {
+      let addresses = results.flat();
       if (!addresses.length) {
-        callback(error, address, family);
-        return;
+        const provider = await resolveCloudflareAddress(hostname, requestedFamily);
+        addresses = provider.addresses;
+        if (!addresses.length) {
+          callback(Object.assign(error, { relayAddressMissing: provider.missing }), address, family);
+          return;
+        }
       }
       if (options.all) callback(null, addresses);
       else callback(null, addresses[0].address, addresses[0].family);
@@ -276,7 +106,7 @@ var relayLookup = (hostname, options, callback) => {
 async function checkRelay(route, options = {}) {
   options.signal?.throwIfAborted();
   if (route.kind !== "websocket") throw new Error("Expected an internet tunnel address.");
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve2, reject) => {
     const socket = new WebSocket(route.url, { maxPayload: 4096, perMessageDeflate: false, followRedirects: false, lookup: options.lookup ?? relayLookup });
     let finished = false, banner = "";
     const finish = (error) => {
@@ -286,14 +116,21 @@ async function checkRelay(route, options = {}) {
       options.signal?.removeEventListener("abort", aborted);
       socket.terminate();
       if (error) reject(error);
-      else resolve3();
+      else resolve2();
     };
     const aborted = () => finish(options.signal?.reason ?? new Error("Connection check cancelled."));
     const timer = setTimeout(() => finish(new RelayCheckError("timeout", "The internet tunnel isn't responding. Retrying\u2026")), options.timeoutMs ?? 8e3);
     socket.on("error", (error) => {
-      if (["ENOTFOUND", "EAI_AGAIN"].includes(error.code ?? "")) {
+      if (hasCertificateError(error)) {
+        finish(new RelayCheckError("provider_certificate", "The tunnel's TLS certificate could not be verified. Check the provider's certificate and this computer's date and time.", error));
+      } else if (["ENOTFOUND", "EAI_AGAIN"].includes(error.code ?? "")) {
         const provider = new URL(route.url).hostname.endsWith(".trycloudflare.com") ? "Cloudflare's" : "the tunnel's";
-        finish(new RelayCheckError("dns", `Waiting for ${provider} internet address (DNS)\u2026`, error));
+        finish(new RelayCheckError(
+          "dns",
+          `Waiting for ${provider} internet address (DNS)\u2026`,
+          error,
+          error.relayAddressMissing === true
+        ));
       } else if (/(?:[Uu]nexpected server response|[Ee]xpected 101)/.test(error.message)) {
         finish(new RelayCheckError("proxy", "The internet tunnel isn't reaching Mindwire. Retrying\u2026", error));
       } else {
@@ -320,17 +157,17 @@ async function checkRelay(route, options = {}) {
   });
 }
 async function relayProviderReachable(options, signal) {
-  if (options.kind !== "cloudflare" && options.kind !== "ngrok") return false;
+  if (!["cloudflare", "ngrok", "oblien"].includes(options.kind)) return false;
   signal?.throwIfAborted();
-  return new Promise((resolve3) => {
-    const url = options.kind === "cloudflare" ? "https://api.trycloudflare.com/" : "https://api.ngrok.com/";
+  return new Promise((resolve2) => {
+    const url = options.kind === "cloudflare" ? "https://api.trycloudflare.com/" : options.kind === "oblien" ? "https://api.oblien.com/" : "https://api.ngrok.com/";
     let finished = false;
     const done = (reachable) => {
       if (finished) return;
       finished = true;
       clearTimeout(timer);
       probe.destroy();
-      resolve3(reachable);
+      resolve2(reachable);
     };
     const probe = request(url, { method: "HEAD", signal }, (response) => {
       response.destroy();
@@ -343,15 +180,26 @@ async function relayProviderReachable(options, signal) {
 }
 
 // src/computer/controller.ts
+async function saveRelay(file, handle, port, options) {
+  if (handle?.owner?.identity) await writeJSON(file, {
+    owner: handle.owner.identity,
+    port,
+    options: JSON.stringify(options),
+    route: handle.route,
+    outputFile: handle.outputFile,
+    configFile: handle.configFile
+  });
+  else await fs.rm(file, { force: true });
+}
 function recoveryDelay(failures) {
   return Math.min(6e4, 1e3 * 2 ** Math.min(6, Math.max(0, failures - 1)));
 }
 async function superviseComputer(directory) {
-  if ((await readJSON(path3.join(directory, "computer-stopped.json")))?.stopped) return;
-  let config = await readJSON(path3.join(directory, "computer-config.json"));
+  if ((await readJSON(path.join(directory, "computer-stopped.json")))?.stopped) return;
+  let config = await readJSON(path.join(directory, "computer-config.json"));
   if (!config) throw new Error("Computer configuration is missing.");
-  const controllerPath = path3.join(directory, "computer-controller.json");
-  const relayPath = path3.join(directory, "computer-relay.json");
+  const controllerPath = path.join(directory, "computer-controller.json");
+  const relayPath = path.join(directory, "computer-relay.json");
   const previous = await readJSON(controllerPath);
   if (await processStateAlive(previous)) throw new Error("The computer already has a service controller.");
   const owner = await currentProcessIdentity();
@@ -359,6 +207,7 @@ async function superviseComputer(directory) {
   await phase("Preparing Mindwire\u2026");
   let child, relay, stopping = false;
   let relayTask, updateTask;
+  let connectionTask;
   let relayResult;
   let checkTask;
   let checkResult;
@@ -371,30 +220,30 @@ async function superviseComputer(directory) {
   process.on("SIGINT", stop);
   let token;
   try {
-    token = (await fs.readFile(path3.join(directory, "daemon.token"), "utf8")).trim();
+    token = (await fs.readFile(path.join(directory, "daemon.token"), "utf8")).trim();
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
     token = randomBytes(32).toString("hex");
-    await fs.writeFile(path3.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
+    await fs.writeFile(path.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
   }
   const daemonEnv = { ...process.env };
   if (process.platform === "win32") {
     try {
       const git = execFileSync("where.exe", ["git"], { encoding: "utf8", timeout: 3e3, windowsHide: true }).split(/\r?\n/)[0];
       if (git) {
-        const shellDirectory = path3.resolve(path3.dirname(git), "..", "bin");
-        await fs.access(path3.join(shellDirectory, "bash.exe"));
+        const shellDirectory = path.resolve(path.dirname(git), "..", "bin");
+        await fs.access(path.join(shellDirectory, "bash.exe"));
         const pathKey = Object.keys(daemonEnv).find((key) => key.toLowerCase() === "path") ?? "PATH";
-        daemonEnv[pathKey] = `${shellDirectory}${path3.delimiter}${daemonEnv[pathKey] ?? ""}`;
+        daemonEnv[pathKey] = `${shellDirectory}${path.delimiter}${daemonEnv[pathKey] ?? ""}`;
       }
     } catch {
     }
   }
-  const oldRuntime = await readJSON(path3.join(directory, "computer-runtime.json"));
+  const oldRuntime = await readJSON(path.join(directory, "computer-runtime.json"));
   let sshPort = config.sshPort || oldRuntime?.sshPort || 0;
   let websocketPort = config.websocketPort || oldRuntime?.websocketPort || 0;
   const launch = async (binary) => {
-    await fs.rm(path3.join(directory, "computer-runtime.json"), { force: true });
+    await fs.rm(path.join(directory, "computer-runtime.json"), { force: true });
     const process2 = spawn(binary, ["--computer"], {
       cwd: config.directory,
       stdio: ["ignore", "inherit", "inherit"],
@@ -403,8 +252,8 @@ async function superviseComputer(directory) {
         ...daemonEnv,
         DAEMON_TOKEN: token,
         ADDR: "127.0.0.1:0",
-        STATE_PATH: path3.join(directory, "agent-state.json"),
-        WORKSPACE_DB_PATH: path3.join(directory, "workspace.db"),
+        STATE_PATH: path.join(directory, "agent-state.json"),
+        WORKSPACE_DB_PATH: path.join(directory, "workspace.db"),
         AGENT_CWD: config.directory,
         COMPUTER_SSH_ADDR: `${config.bind.includes(":") ? `[${config.bind}]` : config.bind}:${sshPort}`,
         COMPUTER_WS_ADDR: `127.0.0.1:${websocketPort}`,
@@ -415,8 +264,8 @@ async function superviseComputer(directory) {
     process2.on("error", (error) => {
       failure = error;
     });
-    await new Promise((resolve3, reject) => {
-      process2.once("spawn", resolve3);
+    await new Promise((resolve2, reject) => {
+      process2.once("spawn", resolve2);
       process2.once("error", reject);
     });
     child = await ownChild(process2);
@@ -469,14 +318,26 @@ async function superviseComputer(directory) {
       client = await launch(binary);
     }
     const saved = await readJSON(relayPath);
+    const candidatePath = path.join(directory, "computer-relay-candidate.json");
+    const abandonedCandidate = await readJSON(candidatePath);
+    if (abandonedCandidate && (abandonedCandidate.owner.pid !== saved?.owner.pid || abandonedCandidate.owner.start !== saved?.owner.start)) {
+      const abandonedOwner = await adoptProcess(abandonedCandidate.owner);
+      if (abandonedOwner) await (await adoptRelay(abandonedOwner, abandonedCandidate.route, directory, abandonedCandidate.outputFile, abandonedCandidate.configFile)).close();
+    }
+    await fs.rm(candidatePath, { force: true });
     if (saved) {
       const owner2 = await adoptProcess(saved.owner);
       if (owner2) {
         if (saved.outputFile && saved.route && saved.port === websocketPort && saved.options === JSON.stringify(config.relay)) {
-          relay = await adoptRelay(owner2, saved.route, directory, saved.outputFile);
+          relay = await adoptRelay(owner2, saved.route, directory, saved.outputFile, saved.configFile);
+          relayWasReachable = !!previous?.routes?.some((route) => JSON.stringify(route) === JSON.stringify(saved.route));
+          if (previous?.relayFailureSince && relayWasReachable) {
+            relayFailedAt = Math.min(Date.now(), previous.relayFailureSince);
+            relayHealthFailures = previous.relayFailures ?? 0;
+          }
         } else {
           if (!saved.outputFile) await phase("Refreshing the internet tunnel for this update\u2026");
-          const abandoned = await adoptRelay(owner2, saved.route, directory, saved.outputFile);
+          const abandoned = await adoptRelay(owner2, saved.route, directory, saved.outputFile, saved.configFile);
           await abandoned.close();
           await fs.rm(relayPath, { force: true });
         }
@@ -486,6 +347,128 @@ async function superviseComputer(directory) {
     }
     let lastController = "";
     while (!stopping) {
+      const changePath = path.join(directory, "computer-connection-change.json");
+      const change = !connectionTask && !relayTask && !updateTask && !changingDaemon && client && child?.alive() ? await readJSON(changePath) : void 0;
+      if (change && ["queued", "connecting"].includes(change.status)) {
+        connectionTask = (async () => {
+          const previousConfig = config;
+          const next = { ...previousConfig, ...change.patch };
+          let previousRelay = relay;
+          let releasedPrevious = false;
+          let candidate;
+          let committed = false;
+          let lastVerificationError;
+          const changing = new AbortController();
+          const cancel = () => changing.abort();
+          abort.signal.addEventListener("abort", cancel, { once: true });
+          const timeout = setTimeout(cancel, 115e3);
+          const report = (message) => writeJSON(changePath, { ...change, status: "connecting", message });
+          try {
+            await report("Preparing the new connection; your current service keeps running\u2026");
+            if (JSON.stringify(next.relay) === JSON.stringify(previousConfig.relay) && previousRelay && (!previousRelay.owner || previousRelay.owner.alive())) candidate = previousRelay;
+            else {
+              if (previousRelay?.owner && ["ngrok", "oblien"].includes(next.relay.kind) && next.relay.kind === previousConfig.relay.kind && next.relay.url === previousConfig.relay.url) {
+                await report("Refreshing the saved provider connection; your terminals keep running\u2026");
+                releasedPrevious = true;
+                relayReachable = false;
+                await previousRelay.close();
+              }
+              candidate = await startRelay(next.relay, websocketPort, {
+                cacheDir: path.join(directory, "tools"),
+                outputDirectory: directory,
+                cliPath: process.argv[1],
+                signal: changing.signal,
+                onProgress: report,
+                onSpawn: async (owner2, outputFile, configFile) => {
+                  if (owner2.identity) await writeJSON(candidatePath, {
+                    owner: owner2.identity,
+                    port: websocketPort,
+                    options: JSON.stringify(next.relay),
+                    outputFile,
+                    configFile
+                  });
+                }
+              });
+            }
+            if (next.relay.kind !== "none") {
+              if (!candidate?.route) throw new Error("The provider didn't return an address.");
+              await report("Verifying the new secure connection\u2026");
+              for (; ; ) {
+                changing.signal.throwIfAborted();
+                try {
+                  await checkRelay(candidate.route, { signal: changing.signal });
+                  break;
+                } catch (error) {
+                  if (error instanceof Error) lastVerificationError = error;
+                  if (error instanceof RelayCheckError && providerNeedsAction(error.code)) throw error;
+                  await setTimeout$1(2e3, void 0, { signal: changing.signal });
+                }
+              }
+            }
+            changing.signal.throwIfAborted();
+            const nextRoutes = directRoutes(next, sshPort);
+            if (candidate?.route) nextRoutes.push(candidate.route);
+            if (!nextRoutes.length) throw new Error("No reachable address was configured.");
+            await client.computer.setRoutes(nextRoutes, connectionInfo(next.relay, next.host));
+            await writeJSON(path.join(directory, "computer-config.json"), next);
+            await saveRelay(relayPath, candidate, websocketPort, next.relay);
+            config = next;
+            relay = candidate;
+            routes = nextRoutes;
+            published = "";
+            relayReachable = true;
+            relayWasReachable = true;
+            relayHealthFailures = 0;
+            relayFailedAt = 0;
+            relayError = void 0;
+            relayErrorCode = void 0;
+            checkedAt = Date.now();
+            nextCheckAt = checkedAt + 3e4;
+            committed = true;
+            if (previousRelay && previousRelay !== candidate) await previousRelay.close();
+            await writeJSON(changePath, { ...change, status: "complete", message: "Persistent connection is ready." });
+          } catch (error) {
+            if (!committed) {
+              if (candidate && candidate !== previousRelay) await candidate.close();
+              await writeJSON(path.join(directory, "computer-config.json"), previousConfig);
+              if (releasedPrevious) {
+                previousRelay = void 0;
+                if (!stopping) {
+                  await report("Restoring the previous provider connection\u2026");
+                  try {
+                    previousRelay = await startRelay(previousConfig.relay, websocketPort, {
+                      cacheDir: path.join(directory, "tools"),
+                      outputDirectory: directory,
+                      cliPath: process.argv[1],
+                      signal: abort.signal
+                    });
+                  } catch {
+                  }
+                }
+                relayReachable = false;
+                nextCheckAt = 0;
+                nextRelayAt = 0;
+              }
+              relay = previousRelay;
+              await saveRelay(relayPath, previousRelay, websocketPort, previousConfig.relay);
+              published = "";
+            }
+            await writeJSON(changePath, {
+              ...change,
+              status: committed ? "complete" : "failed",
+              message: committed ? "Connection is ready." : `Connection setup didn't finish. ${error instanceof Error && error.name !== "AbortError" ? error.message : lastVerificationError?.message ?? "Check the provider configuration and internet connection."} The previous service keeps running.`
+            });
+          } finally {
+            clearTimeout(timeout);
+            abort.signal.removeEventListener("abort", cancel);
+            await fs.rm(candidatePath, { force: true });
+          }
+        })().catch(() => {
+          relayError = "The connection change could not be saved. Check free disk space, then run mindwire connection again.";
+        }).finally(() => {
+          connectionTask = void 0;
+        });
+      }
       if (!changingDaemon && child && !child.alive()) {
         child = void 0;
         client = void 0;
@@ -510,7 +493,8 @@ async function superviseComputer(directory) {
           nextDaemonAt = Date.now() + recoveryDelay(++daemonFailures);
         }
       }
-      if (relay?.owner && !relay.owner.alive()) {
+      const requestedCheck = await readJSON(path.join(directory, "computer-check.json"));
+      if (!connectionTask && relay?.owner && !relay.owner.alive()) {
         await relay.close();
         relay = void 0;
         relayReachable = false;
@@ -538,30 +522,35 @@ async function superviseComputer(directory) {
             port: websocketPort,
             options: JSON.stringify(config.relay),
             route: relay.route,
-            outputFile: relay.outputFile
+            outputFile: relay.outputFile,
+            configFile: relay.configFile
           });
         } else {
+          checkedAt = Date.now();
           relayError = result.error instanceof Error ? result.error.message : "The internet tunnel couldn't connect.";
-          nextRelayAt = Date.now() + recoveryDelay(++relayFailures);
+          relayErrorCode = result.error instanceof ProviderConnectionError ? result.error.code : void 0;
+          nextRelayAt = Date.now() + (providerNeedsAction(relayErrorCode) ? 6e4 : recoveryDelay(++relayFailures));
         }
       }
-      if (!relay && !relayTask && Date.now() >= nextRelayAt) {
+      if (!relay && !relayTask && !connectionTask && (Date.now() >= nextRelayAt || (requestedCheck?.requestedAt ?? 0) > checkedAt)) {
         relayError = void 0;
         relayErrorCode = void 0;
         relayMessage = "Reconnecting your internet tunnel\u2026";
         relayTask = startRelay(config.relay, websocketPort, {
-          cacheDir: path3.join(directory, "tools"),
+          cacheDir: path.join(directory, "tools"),
           outputDirectory: directory,
+          cliPath: process.argv[1],
           signal: abort.signal,
           onProgress: (message) => {
             relayMessage = message;
           },
-          onSpawn: async (owner2, outputFile) => {
+          onSpawn: async (owner2, outputFile, configFile) => {
             if (owner2.identity) await writeJSON(relayPath, {
               owner: owner2.identity,
               port: websocketPort,
               options: JSON.stringify(config.relay),
-              outputFile
+              outputFile,
+              configFile
             });
           }
         }).then((handle) => {
@@ -590,7 +579,8 @@ async function superviseComputer(directory) {
             relayFailedAt ||= checkedAt;
             relayHealthFailures++;
             nextCheckAt = checkedAt + Math.min(15e3, recoveryDelay(relayHealthFailures));
-            if (result.canRestart) {
+            if (result.canRestart && !connectionTask) {
+              await phase(result.error instanceof RelayCheckError && result.error.addressMissing ? "Cloudflare's address expired. Creating a new secure tunnel\u2026" : "The internet tunnel stopped responding. Replacing it\u2026");
               await relay.close();
               relay = void 0;
               relayWasReachable = false;
@@ -600,7 +590,6 @@ async function superviseComputer(directory) {
           }
         }
       }
-      const requestedCheck = await readJSON(path3.join(directory, "computer-check.json"));
       if (config.relay.kind === "none") checkedAt = Math.max(checkedAt, requestedCheck?.requestedAt ?? 0);
       if (relay?.route && !checkTask && (Date.now() >= nextCheckAt || (requestedCheck?.requestedAt ?? 0) > checkedAt)) {
         const checking = relay;
@@ -609,17 +598,18 @@ async function superviseComputer(directory) {
             await checkRelay(checking.route, { signal: abort.signal });
             checkResult = { relay: checking };
           } catch (error) {
-            const canRestart = !!checking.owner && relayFailedAt > 0 && relayNeedsRestart(error, relayHealthFailures, Date.now() - relayFailedAt) && await relayProviderReachable(config.relay, abort.signal).catch(() => false);
+            const canRestart = !!checking.owner && relayFailedAt > 0 && relayNeedsRestart(error, relayHealthFailures, Date.now() - relayFailedAt) && (error instanceof RelayCheckError && error.addressMissing || await relayProviderReachable(config.relay, abort.signal).catch(() => false));
             checkResult = { relay: checking, error, canRestart };
           }
         })();
       }
       routes = directRoutes(config, sshPort);
       if (relay?.route && relayWasReachable) routes.push(relay.route);
-      const routeJSON = JSON.stringify(routes);
+      const metadata = connectionInfo(config.relay, config.host);
+      const routeJSON = JSON.stringify({ routes, connection: metadata });
       if (!changingDaemon && client && child?.alive() && routeJSON !== published) {
         try {
-          await client.computer.setRoutes(routes);
+          await client.computer.setRoutes(routes, metadata);
           published = routeJSON;
         } catch {
         }
@@ -635,15 +625,17 @@ async function superviseComputer(directory) {
         phase: ready ? void 0 : daemonError ?? relayError ?? relayMessage,
         error: daemonError ?? relayError,
         errorCode: daemonError ? void 0 : relayErrorCode,
-        recovering: !ready
+        recovering: !ready,
+        relayFailureSince: relayFailedAt || void 0,
+        relayFailures: relayHealthFailures || void 0
       };
       const serialized = JSON.stringify(state);
       if (serialized !== lastController) {
         await writeJSON(controllerPath, state);
         lastController = serialized;
       }
-      const updatePath = path3.join(directory, "computer-update.json");
-      const update = !updateTask && client && child?.alive() ? await readJSON(updatePath) : void 0;
+      const updatePath = path.join(directory, "computer-update.json");
+      const update = !updateTask && !connectionTask && client && child?.alive() ? await readJSON(updatePath) : void 0;
       if (update && ["queued", "downloading", "waiting", "restarting"].includes(update.status)) {
         updateTask = (async () => {
           const status = async (state2, error) => writeJSON(
@@ -682,9 +674,9 @@ async function superviseComputer(directory) {
             }
             binary = replacement;
             config = { ...config, daemonBin: void 0, version: update.version };
-            await writeJSON(path3.join(directory, "computer-config.json"), config);
-            await client.computer.setRoutes(routes);
-            published = JSON.stringify(routes);
+            await writeJSON(path.join(directory, "computer-config.json"), config);
+            await client.computer.setRoutes(routes, connectionInfo(config.relay, config.host));
+            published = "";
             await status("complete");
           } catch (error) {
             await status("failed", error instanceof Error ? error.message : "Service update failed.");
@@ -706,6 +698,7 @@ async function superviseComputer(directory) {
     await relayTask;
     await checkTask;
     await updateTask;
+    await connectionTask;
     if (relayResult?.handle && relayResult.handle !== relay) await relayResult.handle.close();
     await relay?.close();
     if (child) await child.close();
@@ -716,5 +709,5 @@ async function superviseComputer(directory) {
 }
 
 export { recoveryDelay, superviseComputer };
-//# sourceMappingURL=controller-QBC6L7AT.js.map
-//# sourceMappingURL=controller-QBC6L7AT.js.map
+//# sourceMappingURL=controller-2SJLZMJZ.js.map
+//# sourceMappingURL=controller-2SJLZMJZ.js.map