mindwire 0.1.34 → 0.1.36

package/dist/cli.js

@@ -1,18 +1,22 @@
 #!/usr/bin/env node
-import { defaultStateDirectory, superviseComputer, ensureComputer, computerPairingURI, stopComputer, computerClient, SDK_VERSION, readJSON, writeJSON, currentProcessIdentity, processStateAlive, acquireProcessLock, computerPairingQRData } from './chunk-3QFDSYKC.js';
-import './chunk-T6TD76UA.js';
+import { connectionAddress, connectionInfo, connectionDescription } from './chunk-67BNDGRK.js';
+import { defaultStateDirectory, superviseComputer, computerClient, ensureComputer, readJSON, defaultComputerConfig, computerPairingURI, stopComputer, SDK_VERSION, providerFailure, writeJSON, currentProcessIdentity, processStateAlive, acquireProcessLock, websocketURL, providerNeedsAction, cloudflareCommand, computerPairingQRData, ProviderConnectionError } from './chunk-RTGZDLSG.js';
+import './chunk-PFYKJ6LX.js';
 import { promisify, parseArgs } from 'util';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { realpathSync, mkdtempSync, chmodSync, writeFileSync, rmSync } from 'fs';
 import * as path from 'path';
 import { join } from 'path';
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { createInterface } from 'readline/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
 import { execFile, spawn } from 'child_process';
-import { homedir, tmpdir } from 'os';
+import { homedir, hostname, tmpdir } from 'os';
 import * as fs from 'fs/promises';
-import { cursorTo, clearLine } from 'readline';
+import { rm } from 'fs/promises';
+import { cursorTo, clearLine, createInterface as createInterface$1 } from 'readline';
+import { TunnelClient, Oblien } from 'oblien';
+import { Writable } from 'stream';
 
 var enterScreen = "\x1B[?1049h\x1B[?25l";
 var leaveScreen = "\x1B[0m\x1B[?25h\x1B[?1049l";
@@ -425,8 +429,10 @@ function approvalCommand(pairingId, requestId) {
   return `mindwire approve -- ${pairingId} ${requestId}`;
 }
 async function chooseConnectionAction(options) {
-  if (options.requested === "pair" || options.requested === "reconnect") return "pair";
-  return options.devices.some((device) => !device.revoked && device.connected) ? "resume" : "pair";
+  if (options.requested === "pair") return "pair";
+  const recoverable = options.persistent || options.devices.some((device) => !device.revoked && device.addressRecovery);
+  if (options.requested === "reconnect" && !recoverable) return "pair";
+  return options.devices.some((device) => !device.revoked && (device.connected || recoverable)) ? "resume" : "pair";
 }
 async function choosePairingDecision(options) {
   const replacements = options.replacements.filter((device) => !device.revoked);
@@ -508,13 +514,664 @@ var ConnectionProgress = class {
   }
 };
 
+// src/computer/directory-http.ts
+var DirectoryRequestError = class extends Error {
+  constructor(status, code, retryAfter = 0) {
+    super(
+      status === 0 ? "Couldn't reach the address directory securely. Check its HTTPS address and retry." : `The address directory rejected the request (${code}).`
+    );
+    this.status = status;
+    this.code = code;
+    this.retryAfter = retryAfter;
+  }
+  status;
+  code;
+  retryAfter;
+};
+async function directoryRequest(url, path5, body) {
+  let response;
+  try {
+    response = await fetch(url + path5, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4),
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+  } catch {
+    throw new DirectoryRequestError(0, "unreachable");
+  }
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    if (reader)
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        length += value.byteLength;
+        if (length > 64 * 1024) throw new Error("The address directory returned an oversized response.");
+        chunks.push(value);
+      }
+  } finally {
+    void reader?.cancel().catch(() => {
+    });
+  }
+  let data;
+  try {
+    data = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new DirectoryRequestError(response.status, "invalid_response");
+  }
+  if (!response.ok) {
+    const error = data?.error;
+    const code = typeof error === "string" ? error : error?.code;
+    const retryAfter = Number(response.headers.get("Retry-After"));
+    throw new DirectoryRequestError(
+      response.status,
+      typeof code === "string" && /^[a-z_]{1,64}$/.test(code) ? code : "directory_error",
+      Number.isFinite(retryAfter) ? Math.max(0, Math.min(60, retryAfter)) : 0
+    );
+  }
+  return data;
+}
+
+// src/computer/discovery.ts
+var DIRECTORY_API_PATH = "/api/computer-directory/v1";
+var DIRECTORY_URL = `https://console.mindwire.sh${DIRECTORY_API_PATH}`;
+function directoryURL(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Enter the directory's HTTPS API URL.");
+  }
+  if (value.length > 2048 || /[\s\x00]/.test(value) || url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+    throw new Error("Use an HTTPS directory URL without credentials, a query, or a fragment.");
+  }
+  if (url.pathname === "/") url.pathname = DIRECTORY_API_PATH;
+  if (url.pathname.endsWith("/") || url.pathname.includes("//") || url.pathname.includes("%")) {
+    throw new Error("Use the exact directory API URL without a trailing slash.");
+  }
+  return url.href;
+}
+async function enableAddressDiscovery(options) {
+  const lock = await acquireProcessLock(join(options.directory, "discovery-setup.lock"));
+  try {
+    let status;
+    try {
+      status = await options.computer.computer.discovery();
+    } catch (error) {
+      if (error.status === 404)
+        throw new Error("Update the Mindwire service before enabling automatic address recovery.");
+      throw error;
+    }
+    const url = directoryURL(
+      options.url ?? process.env.MINDWIRE_DIRECTORY_URL ?? status.url ?? DIRECTORY_URL
+    );
+    if (status.url && status.url !== url && (status.enabled || (status.sequence ?? 0) !== (status.publishedSequence ?? 0))) {
+      throw new Error(
+        "Disable the current directory with mindwire discovery disable and wait for its withdrawal before changing the directory URL."
+      );
+    }
+    if (!status.enabled || status.url !== url || status.error?.includes("enrollment")) {
+      options.prompt.print(`Enabling encrypted address recovery with ${new URL(url).host}\u2026`);
+      try {
+        const challenge = await directoryRequest(url, "/registrations/challenge", {
+          directoryId: status.directoryId
+        });
+        if (typeof challenge?.challenge !== "string" || challenge.challenge.length < 16 || challenge.challenge.length > 2048) {
+          throw new Error("The address directory returned an invalid enrollment challenge.");
+        }
+        const proof = await options.computer.computer.directoryEnrollment(url, challenge.challenge);
+        const enrolled = await directoryRequest(url, "/registrations", proof);
+        if (enrolled?.directoryId !== status.directoryId)
+          throw new Error("The directory acknowledged a different computer.");
+      } catch (error) {
+        if (error instanceof DirectoryRequestError) {
+          if (error.status === 404 || error.status === 501)
+            throw new Error(
+              "The address directory isn't available at this URL. Your existing connection still works; retry after the backend is deployed."
+            );
+          if (error.status === 409)
+            throw new Error(
+              "This computer's directory registration is revoked or conflicts with its saved identity. Contact the directory operator."
+            );
+          if (error.code === "account_required")
+            throw new Error(
+              "This directory still requires an account. Update its Mindwire backend to enable key-based registration, or choose another directory with --directory-url."
+            );
+          if (error.status === 401 || error.status === 403)
+            throw new Error(
+              "The directory couldn't verify this computer's key or challenge. Retry enrollment."
+            );
+          if (error.status === 429)
+            throw new Error(
+              "The directory's registration limit was reached. Retry later or use another directory."
+            );
+          if (error.status === 503)
+            throw new Error(
+              "The directory is temporarily unavailable or at capacity. Your existing connection still works."
+            );
+        }
+        throw error;
+      }
+      status = await options.computer.computer.configureDiscovery(true, url);
+    }
+    const deadline = Date.now() + 15e3;
+    while (Date.now() < deadline) {
+      status = await options.computer.computer.discovery();
+      if (status.enabled && status.sequence && status.publishedSequence === status.sequence) return status;
+      if (status.error?.includes("enrollment") || status.error?.includes("older revision"))
+        throw new Error(status.error);
+      await setTimeout$1(250);
+    }
+    throw new Error(
+      "Address recovery is configured and will retry in the background. Run mindwire discovery status to check publication."
+    );
+  } finally {
+    await lock?.close();
+  }
+}
+function discoveryDescription(status) {
+  if (!status?.enabled) return "Automatic address recovery is off. Enable it with mindwire discovery enable.";
+  if (status.error) return status.error;
+  return status.sequence && status.publishedSequence === status.sequence ? "Encrypted address recovery is on. Saved phones can find this computer when its tunnel address changes." : "Publishing the computer's encrypted address\u2026";
+}
+var BASE = "https://api.oblien.com";
+var RENEW_BEFORE_MS = 24 * 60 * 6e4;
+var ProviderSignInRequired = class extends Error {
+  code = "provider_sign_in";
+  constructor(provider = "Oblien") {
+    super(`Sign in to ${provider} again with mindwire connection ${provider.toLowerCase()}. Your computer and phone keys are unchanged.`);
+  }
+};
+function tokenExpiry(token) {
+  try {
+    const value = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString());
+    return typeof value.exp === "number" && Number.isFinite(value.exp) ? value.exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function oblienClient(credentials) {
+  const baseUrl = credentials.baseUrl ?? BASE;
+  const url = new URL(baseUrl);
+  if (url.protocol !== "https:" || url.username || url.password) throw new Error("Oblien requires an HTTPS API address without embedded credentials.");
+  if (credentials.clientId && credentials.clientSecret) return boundedOblienClient(new Oblien({ baseUrl, clientId: credentials.clientId, clientSecret: credentials.clientSecret }));
+  if (credentials.token) return boundedOblienClient(new Oblien({ baseUrl, token: credentials.token }));
+  throw new ProviderSignInRequired();
+}
+function boundedOblienClient(client, timeoutMs = 15e3) {
+  const request = client._http.request.bind(client._http);
+  client._http.request = async (options) => {
+    const controller = new AbortController();
+    const cancel = () => controller.abort(options.signal?.reason);
+    const timer = setTimeout(() => controller.abort(new Error("Oblien's API did not respond in time.")), timeoutMs);
+    options.signal?.addEventListener("abort", cancel, { once: true });
+    if (options.signal?.aborted) cancel();
+    try {
+      return await request({ ...options, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", cancel);
+    }
+  };
+  return client;
+}
+function requiresSignIn(error) {
+  return error instanceof ProviderSignInRequired || [401, 403].includes(error?.status ?? 0);
+}
+async function authenticatedOblien(file, options = {}) {
+  const lock = await acquireProcessLock(file + ".lock");
+  try {
+    const credentials = await readJSON(file);
+    if (!credentials) throw new ProviderSignInRequired();
+    const client = (options.client ?? oblienClient)(credentials);
+    if (!credentials.token || credentials.clientId && credentials.clientSecret) return client;
+    const now = (options.now ?? Date.now)(), expires = tokenExpiry(credentials.token);
+    if (expires !== void 0 && expires <= now) throw new ProviderSignInRequired();
+    if (expires !== void 0 && expires - now > RENEW_BEFORE_MS) return client;
+    try {
+      const renewed = await client._http.request({
+        method: "POST",
+        path: "/auth/token",
+        body: { old_token: credentials.token },
+        signal: AbortSignal.timeout(15e3)
+      });
+      if (!renewed.token) throw new ProviderSignInRequired();
+      const next = (options.client ?? oblienClient)({ ...credentials, token: renewed.token });
+      await next._http.request({ method: "GET", path: "/settings/profile", signal: AbortSignal.timeout(15e3) });
+      await writeJSON(file, { ...credentials, token: renewed.token });
+      return next;
+    } catch (error) {
+      if (requiresSignIn(error)) throw new ProviderSignInRequired();
+      throw error;
+    }
+  } finally {
+    await lock?.close();
+  }
+}
+async function signInOblien(file, prompt) {
+  const candidates = await Promise.all([
+    readJSON(file),
+    readJSON(path.join(homedir(), ".oblien", "credentials.json"))
+  ]);
+  for (const existing of candidates) {
+    if (!existing || !(existing.token || existing.clientId && existing.clientSecret)) continue;
+    const temporary = `${file}.login-${randomUUID()}.json`;
+    await writeJSON(temporary, existing);
+    try {
+      const client2 = await authenticatedOblien(temporary);
+      await client2._http.request({ method: "GET", path: "/settings/profile", signal: AbortSignal.timeout(15e3) });
+      await writeJSON(file, await readJSON(temporary));
+      return client2;
+    } catch (error) {
+      if (!requiresSignIn(error)) throw error;
+    } finally {
+      await rm(temporary, { force: true });
+    }
+  }
+  const client = boundedOblienClient(new Oblien({ token: "", baseUrl: BASE }));
+  const session = await client._http.request({ method: "POST", path: "/auth/token", signal: AbortSignal.timeout(15e3) });
+  if (!session.token) throw new Error("Oblien couldn't start sign-in. Try again shortly.");
+  client.setToken(session.token);
+  const login = await client._http.request({
+    method: "POST",
+    path: "/auth/session",
+    body: { app: "oblien", redirect_url: "https://oblien.com/cli?login=success" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  const url = new URL(login.url);
+  if (url.protocol !== "https:" || url.hostname !== "auth.oblien.com" || url.username || url.password) throw new Error("Oblien returned an invalid sign-in link.");
+  const id = url.pathname.split("/").filter(Boolean).pop();
+  if (!id || !/^[\w-]+$/.test(id)) throw new Error("Oblien returned an invalid sign-in session.");
+  prompt.print(`
+Sign in to Oblien in your browser:
+${url.href}
+
+Waiting for sign-in\u2026`);
+  prompt.open(url.href);
+  const deadline = Date.now() + 5e3 * 60;
+  while (Date.now() < deadline) {
+    await setTimeout$1(2e3);
+    const result = await client._http.request({ method: "GET", path: `/auth/session/${id}/poll`, signal: AbortSignal.timeout(15e3) });
+    if (result.status === "expired") throw new Error("Oblien sign-in expired. Run mindwire connection oblien to retry.");
+    if (result.status !== "authenticated") continue;
+    await client._http.request({ method: "GET", path: "/settings/profile", signal: AbortSignal.timeout(15e3) });
+    await writeJSON(file, { token: session.token });
+    prompt.print("Signed in to Oblien.");
+    return client;
+  }
+  throw new Error("Oblien sign-in timed out. Run mindwire connection oblien to retry.");
+}
+
+// src/computer/provider-setup.ts
+var execute2 = promisify(execFile);
+async function chooseProvider(prompt) {
+  prompt.print("\nConnect this computer\n\n  1  Automatic \u2014 free Cloudflare tunnel + Mindwire address recovery, no account\n  2  Oblien \u2014 persistent address, browser sign-in\n  3  Cloudflare \u2014 your account and domain\n  4  ngrok \u2014 your account and reserved domain\n  5  Your VPN \u2014 direct SSH\n  6  Existing secure tunnel\n  7  Temporary Cloudflare connection \u2014 no address recovery\n");
+  for (; ; ) {
+    const answer = (await prompt.question("Connection [1]: ")).trim();
+    const provider = ["automatic", "oblien", "cloudflare", "ngrok", "vpn", "custom", "temporary"][Number(answer || "1") - 1];
+    if (provider) return provider;
+    prompt.print("Choose 1\u20137.");
+  }
+}
+function connectionProvider(value) {
+  if (["oblien", "cloudflare", "ngrok", "vpn", "custom", "temporary", "automatic"].includes(value)) return value;
+  throw new Error("Choose automatic, oblien, cloudflare, ngrok, vpn, custom or temporary.");
+}
+function providerHostname(value) {
+  const url = new URL(websocketURL(value.includes("://") ? value : `https://${value}`));
+  if (url.port || url.search || url.pathname !== "/ssh" || !url.hostname.includes(".") || /[\s]/.test(value)) {
+    throw new Error("Enter the configured public hostname, for example computer.example.com.");
+  }
+  return url.hostname;
+}
+async function prepareOblienTunnel(client, stateFile, port) {
+  let state = await readJSON(stateFile);
+  if (!state) {
+    state = { installationId: randomUUID() };
+    await writeJSON(stateFile, state);
+  }
+  if (state.oblien) {
+    try {
+      const { tunnel: tunnel2 } = await client.edgeTunnel.get(state.oblien.id);
+      if (tunnel2.status !== "active") throw new Error("This computer's Oblien tunnel is disabled. Enable it in your Oblien dashboard, then retry.");
+      if (tunnel2.port !== port) await client.edgeTunnel.update(tunnel2.id, { port });
+      const saved2 = { id: tunnel2.id, url: websocketURL(tunnel2.url) };
+      await writeJSON(stateFile, { ...state, oblien: saved2 });
+      return saved2;
+    } catch (error) {
+      if (error?.status !== 404) throw error;
+    }
+  }
+  const slug = `mw-${state.installationId.replaceAll("-", "")}`;
+  const { tunnels } = await client.edgeTunnel.list();
+  const existing = tunnels.find((tunnel2) => tunnel2.slug === slug);
+  const tunnel = existing ?? (await client.edgeTunnel.create({ name: `Mindwire \xB7 ${hostname()}`, slug, port })).tunnel;
+  if (tunnel.status !== "active") throw new Error("This computer's tunnel is disabled in Oblien.");
+  if (tunnel.port !== port) await client.edgeTunnel.update(tunnel.id, { port });
+  const saved = { id: tunnel.id, url: websocketURL(tunnel.url) };
+  await writeJSON(stateFile, { ...state, oblien: saved });
+  return saved;
+}
+async function runVisible(command, args) {
+  await new Promise((resolve2, reject) => {
+    const child = spawn(command, args, { stdio: "inherit", windowsHide: true });
+    child.once("error", () => reject(new Error("Couldn't open the provider's login helper. Try again.")));
+    child.once("exit", (code) => code === 0 ? resolve2() : reject(new Error("Provider setup didn't finish. Your existing connection is unchanged.")));
+  });
+}
+async function setupCloudflare(directory, stateFile, prompt) {
+  const state = await readJSON(stateFile);
+  const domain = providerHostname(await prompt.question("Cloudflare hostname (for example computer.example.com): "));
+  const command = await cloudflareCommand({ cacheDir: path.join(directory, "tools"), onProgress: (text) => prompt.print(text) });
+  let saved = state.cloudflare;
+  if (!saved) {
+    const certificates = process.env.TUNNEL_ORIGIN_CERT ? [process.env.TUNNEL_ORIGIN_CERT] : [path.join(homedir(), ".cloudflared", "cert.pem"), path.join(homedir(), ".cloudflare-warp", "cert.pem")];
+    const hasLogin = (await Promise.all(certificates.map((file) => fs.stat(file).then((value) => value.isFile(), () => false)))).some(Boolean);
+    if (!hasLogin) {
+      prompt.print("\nSign in to Cloudflare and select the zone for this hostname.\nCloudflare will store its login certificate on this computer.");
+      await runVisible(command, ["tunnel", "login"]);
+    } else prompt.print("Using your saved Cloudflare login.");
+    const name = `mindwire-${state.installationId}`;
+    const credentialsFile = path.join(directory, "providers", "cloudflare-tunnel.json");
+    let credentials = await readJSON(credentialsFile);
+    if (!credentials?.TunnelID) {
+      try {
+        await execute2(command, ["tunnel", "create", "--credentials-file", credentialsFile, name], { timeout: 6e4, maxBuffer: 65536 });
+      } catch {
+        throw new Error("Cloudflare couldn't create the named tunnel. Check your account and run mindwire connection cloudflare again.");
+      }
+      credentials = await readJSON(credentialsFile);
+    }
+    if (!credentials?.TunnelID || !/^[a-f0-9-]{36}$/i.test(credentials.TunnelID)) throw new Error("Cloudflare didn't save the tunnel credentials. Retry setup.");
+    await fs.chmod(credentialsFile, 384);
+    saved = { id: credentials.TunnelID, credentialsFile };
+    await writeJSON(stateFile, { ...state, cloudflare: saved });
+  }
+  try {
+    await execute2(command, ["tunnel", "route", "dns", saved.id, domain], { timeout: 6e4, maxBuffer: 65536 });
+  } catch {
+    throw new Error("Cloudflare couldn't assign this hostname. Check the zone and existing DNS record, then retry. Mindwire does not overwrite another service's DNS.");
+  }
+  return { kind: "cloudflare", url: `wss://${domain}/ssh`, cloudflareTunnelId: saved.id, cloudflareCredentialsFile: saved.credentialsFile };
+}
+async function setupProvider(options) {
+  const { directory, provider, prompt } = options;
+  await fs.mkdir(path.join(directory, "providers"), { recursive: true, mode: 448 });
+  const lock = await acquireProcessLock(path.join(directory, "connection-setup.lock"));
+  try {
+    const config = options.config ?? defaultComputerConfig();
+    const stateFile = path.join(directory, "computer-providers.json");
+    if (!await readJSON(stateFile)) await writeJSON(stateFile, { installationId: randomUUID() });
+    switch (provider) {
+      case "automatic":
+        prompt.print("No Mindwire or Oblien account is needed. Cloudflare carries encrypted SSH traffic; the Mindwire directory helps your paired phone find this computer when its address changes. Use --directory-url or MINDWIRE_DIRECTORY_URL for a self-hosted directory.");
+        return { relay: { kind: "cloudflare" } };
+      case "temporary":
+        return { relay: { kind: "cloudflare" } };
+      case "vpn": {
+        prompt.print("Use a hostname reachable from your phone's VPN, such as your Tailscale or WireGuard network. Mindwire still checks your paired SSH keys.");
+        const host = (await prompt.question("Computer's VPN hostname or IP: ")).trim();
+        if (!host || host.length > 255 || /[\s/\\?#@]/.test(host)) throw new Error("Enter a valid VPN hostname or IP address.");
+        return { relay: { kind: "none" }, host };
+      }
+      case "custom": {
+        prompt.print(`Forward WebSocket traffic to http://127.0.0.1:${config.websocketPort || 8792}. Keep your tunnel running at a persistent HTTPS hostname.`);
+        return { relay: { kind: "custom", url: websocketURL(await prompt.question("Secure tunnel URL: ")) } };
+      }
+      case "cloudflare":
+        return { relay: await setupCloudflare(directory, stateFile, prompt) };
+      case "ngrok": {
+        const url = "https://dashboard.ngrok.com/get-started/your-authtoken";
+        prompt.print(`
+Sign in to ngrok to get this computer's authtoken:
+${url}
+The token stays on this computer and is never sent to your phone.`);
+        prompt.open(url);
+        const token = await prompt.secret("ngrok authtoken (hidden): ");
+        if (!token || token.length > 4096 || /\s/.test(token)) throw new Error("Enter a valid ngrok authtoken.");
+        prompt.print("Use the dev domain or reserved domain shown at https://dashboard.ngrok.com/domains. Each computer needs its own address.");
+        const host = providerHostname(await prompt.question("ngrok domain: "));
+        const tokenFile = path.join(directory, "providers", `ngrok-${randomUUID()}.json`);
+        await writeJSON(tokenFile, { token });
+        return { relay: { kind: "ngrok", url: `wss://${host}/ssh`, ngrokTokenFile: tokenFile } };
+      }
+      case "oblien": {
+        const credentialsFile = path.join(directory, "providers", `oblien-${randomUUID()}.json`);
+        const existing = config.relay.oblienCredentialsFile && await readJSON(config.relay.oblienCredentialsFile);
+        if (existing) await writeJSON(credentialsFile, existing);
+        try {
+          const client = await signInOblien(credentialsFile, prompt);
+          const runtime = await readJSON(path.join(directory, "computer-runtime.json"));
+          const tunnel = await prepareOblienTunnel(client, stateFile, runtime?.websocketPort || config.websocketPort || 8792);
+          return { relay: { kind: "oblien", url: tunnel.url, oblienTunnelId: tunnel.id, oblienCredentialsFile: credentialsFile } };
+        } catch (error) {
+          await fs.rm(credentialsFile, { force: true });
+          throw error;
+        }
+      }
+    }
+    throw new Error("Unsupported connection provider.");
+  } finally {
+    await lock?.close();
+  }
+}
+function openSetupURL(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password) throw new Error("Invalid provider login URL.");
+  const [command, args] = process.platform === "darwin" ? ["open", [url.href]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url.href]] : ["xdg-open", [url.href]];
+  const child = spawn(command, [...args], { stdio: "ignore", windowsHide: true });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+function question(text, hidden) {
+  if (!process.stdin.isTTY) throw new Error("Connection setup needs an interactive terminal, or explicit provider options.");
+  process.stderr.write(text);
+  const output = hidden ? new Writable({ write(_chunk, _encoding, done) {
+    done();
+  } }) : process.stderr;
+  const input = createInterface$1({ input: process.stdin, output, terminal: true });
+  return new Promise((resolve2, reject) => {
+    let answered = false;
+    input.once("SIGINT", () => {
+      input.close();
+    });
+    input.once("close", () => {
+      if (!answered) reject(new Error("Connection setup cancelled."));
+    });
+    input.question("", (value) => {
+      answered = true;
+      input.close();
+      if (hidden) process.stderr.write("\n");
+      resolve2(value.trim());
+    });
+  });
+}
+var terminalSetupPrompt = {
+  question: (text) => question(text, false),
+  secret: (text) => question(text, true),
+  print: (text) => {
+    process.stderr.write(text + "\n");
+  },
+  open: openSetupURL
+};
+var OblienTunnelLease = class {
+  constructor(tunnelId, client, now = Date.now) {
+    this.tunnelId = tunnelId;
+    this.client = client;
+    this.now = now;
+  }
+  tunnelId;
+  client;
+  now;
+  value;
+  pending;
+  get(force = false) {
+    if (this.pending) return this.pending;
+    const expires = this.value && (Date.parse(this.value.expires_at) || tokenExpiry(this.value.token) || 0);
+    if (!force && this.value && expires - this.now() > 5 * 6e4) return Promise.resolve(this.value);
+    const pending = (async () => {
+      const client = await this.client();
+      const value = await client.edgeTunnel.issueToken(this.tunnelId);
+      const url = new URL(value.connect_url);
+      if (url.protocol !== "wss:" || url.username || url.password || url.hash) {
+        throw new ProviderConnectionError("provider_configuration", "Oblien returned an invalid broker address.");
+      }
+      const expiry = Date.parse(value.expires_at) || tokenExpiry(value.token) || 0;
+      if (!value.token || expiry - this.now() < 3e4) throw new Error("Oblien returned a token too close to expiry. Retry shortly.");
+      this.value = value;
+      return value;
+    })();
+    this.pending = pending;
+    void pending.finally(() => {
+      if (this.pending === pending) this.pending = void 0;
+    }).catch(() => {
+    });
+    return pending;
+  }
+};
+async function runOblien(options, port, signal) {
+  if (!options.oblienCredentialsFile || !options.oblienTunnelId || !options.url) throw new Error("Oblien setup is incomplete. Run mindwire connection oblien.");
+  const credentialsFile = options.oblienCredentialsFile;
+  const lease = new OblienTunnelLease(options.oblienTunnelId, () => authenticatedOblien(credentialsFile));
+  let failures = 0, authFailures = 0, forceToken = false;
+  while (!signal.aborted) {
+    let carrier;
+    try {
+      const token = await lease.get(forceToken);
+      forceToken = false;
+      signal.throwIfAborted();
+      carrier = new TunnelClient({ connectUrl: token.connect_url, token: token.token, localPort: port, tokenExpiresAt: token.expires_at });
+      const tunnel = carrier;
+      let opened = false;
+      let connectionError;
+      let finish;
+      const ended = new Promise((resolve2) => {
+        finish = resolve2;
+      });
+      let endedValue = false;
+      const end = () => {
+        endedValue = true;
+        finish();
+      };
+      tunnel.on("open", () => {
+        opened = true;
+        failures = 0;
+        authFailures = 0;
+        process.stdout.write(JSON.stringify({ event: "relay_ready", url: options.url }) + "\n");
+      });
+      tunnel.on("disconnect", end);
+      tunnel.on("auth-failed", () => {
+        connectionError = new ProviderSignInRequired();
+        end();
+      });
+      tunnel.on("error", (error) => {
+        connectionError = error;
+        end();
+      });
+      const abort = () => {
+        tunnel.close();
+        end();
+      };
+      signal.addEventListener("abort", abort, { once: true });
+      try {
+        tunnel.connect();
+        const started = Date.now();
+        while (!endedValue && !signal.aborted) {
+          const tick = new AbortController();
+          try {
+            await Promise.race([ended, setTimeout$1(opened ? 6e4 : 1e3, void 0, { signal: tick.signal })]);
+          } finally {
+            tick.abort();
+          }
+          if (!opened && Date.now() - started > 2e4) break;
+          if (opened && !endedValue) {
+            await lease.get().catch(() => {
+            });
+          }
+        }
+        if (connectionError) throw connectionError;
+      } finally {
+        signal.removeEventListener("abort", abort);
+      }
+    } catch (error) {
+      if (signal.aborted) return;
+      const failure = providerFailure(error, "Oblien");
+      if (failure.code === "provider_sign_in" && carrier && ++authFailures === 1) forceToken = true;
+      else if (providerNeedsAction(failure.code)) throw failure;
+    } finally {
+      carrier?.close();
+    }
+    if (!signal.aborted) await setTimeout$1(Math.min(3e4, 1e3 * 2 ** Math.min(5, failures++)), void 0, { signal });
+  }
+}
+async function runNgrok(options, port, signal) {
+  if (!options.ngrokTokenFile || !options.url) throw new Error("ngrok setup is incomplete. Run mindwire connection ngrok.");
+  const credentials = await readJSON(options.ngrokTokenFile);
+  if (!credentials?.token) throw new ProviderSignInRequired("ngrok");
+  const ngrok = await import('@ngrok/ngrok');
+  const domain = new URL(websocketURL(options.url)).hostname;
+  const listener = await ngrok.forward({
+    addr: `http://127.0.0.1:${port}`,
+    authtoken: credentials.token,
+    domain,
+    schemes: ["https"],
+    onStatusChange: () => {
+    }
+  });
+  try {
+    if (websocketURL(listener.url() ?? "") !== websocketURL(options.url)) throw new Error("ngrok returned a different address.");
+    process.stdout.write(JSON.stringify({ event: "relay_ready", url: options.url }) + "\n");
+    if (!signal.aborted) await new Promise((resolve2) => signal.addEventListener("abort", () => resolve2(), { once: true }));
+  } finally {
+    await listener.close();
+    await ngrok.disconnect();
+  }
+}
+async function runManagedRelay(file) {
+  const config = await readJSON(file);
+  if (!config || !Number.isInteger(config.port) || config.port < 1 || config.port > 65535) throw new Error("Invalid relay configuration.");
+  const abort = new AbortController(), stop = () => abort.abort();
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  try {
+    if (config.options.kind === "oblien") await runOblien(config.options, config.port, abort.signal);
+    else if (config.options.kind === "ngrok") await runNgrok(config.options, config.port, abort.signal);
+    else throw new Error("Unsupported managed relay.");
+  } catch (error) {
+    if (!abort.signal.aborted) {
+      const failure = providerFailure(error, config.options.kind === "oblien" ? "Oblien" : "ngrok");
+      process.stdout.write(JSON.stringify({ event: "relay_error", message: failure.message, code: failure.code }) + "\n");
+      process.exitCode = 1;
+    }
+  } finally {
+    process.off("SIGTERM", stop);
+    process.off("SIGINT", stop);
+  }
+}
+
 // src/cli.ts
 var help = `Mindwire \u2014 connect this computer to your phone
 
   npm install -g mindwire
   mindwire connect                       Connect your phone; saved keys reconnect automatically
-  mindwire reconnect                     Show a connection QR again (also repairs a missing pairing)
-  mindwire connect pair                  Pair another phone with this computer
+  mindwire reconnect                     Retry the saved connection
+  mindwire connect pair                  Pair a phone, or repair a lost phone key/address
+  mindwire connection                    Choose a persistent connection provider
+  mindwire connection automatic          Cloudflare traffic with encrypted Mindwire address recovery
+  mindwire connection oblien             Sign in and use an Oblien tunnel
+  mindwire connection cloudflare         Sign in and configure your Cloudflare domain
+  mindwire connection ngrok              Connect your ngrok account and reserved domain
+  mindwire discovery enable              Enable encrypted address recovery (no account)
+  mindwire discovery status              Check encrypted address recovery
+  mindwire discovery disable             Withdraw the saved address directory
   mindwire connect --relay none --host laptop.tailnet  Use your existing VPN
   mindwire connect --relay none           Direct SSH only (reachable network required)
   mindwire connect --relay cloudflare     Cloudflare quick tunnel
@@ -533,9 +1190,13 @@ var help = `Mindwire \u2014 connect this computer to your phone
 Options:
   --directory PATH                       Initial workspace directory (default: home)
   --host HOST                            Reachable LAN, public or VPN hostname
-  --relay none|cloudflare|ngrok|custom     Provider (default: Cloudflare internet tunnel)
+  --relay none|oblien|cloudflare|ngrok|custom  Explicit provider (skips the setup menu)
   --relay-url URL                        Stable configured WebSocket hostname
   --cloudflare-token-file PATH            Named Cloudflare tunnel token file
+  --ngrok-token-file PATH                 Private JSON file containing {"token":"\u2026"}
+  --oblien-credentials-file PATH          Private Oblien session/API credential JSON
+  --oblien-tunnel-id ID                   This computer's existing Oblien tunnel ID
+  --directory-url URL                    Directory HTTPS API URL (or MINDWIRE_DIRECTORY_URL)
   --state-dir PATH                       Private state directory
   --json                                 Structured output (QR invitation includes a secret)
   --qr auto|terminal|browser              Fit the QR to your terminal or open a local page
@@ -544,10 +1205,10 @@ Options:
   --no-startup                            Skip automatic startup setup
   --replace-device DEVICE_ID              With approve: replace a lost phone key (repeatable)
 
-The default works across Wi-Fi and mobile networks. Mindwire privately downloads
-a verified Cloudflare helper when needed. Relays carry encrypted SSH.
-Quick tunnel addresses change on restart; use a stable hostname/VPN for regular use.
-ngrok needs its installed CLI and account. Direct SSH needs no relay when reachable.
+Interactive setup offers persistent addresses across Wi-Fi and mobile networks.
+Provider logins and tokens stay on your computer. Relays carry encrypted SSH;
+they can see connection metadata, but cannot decrypt files, commands or chats.
+Quick Cloudflare tunnels remain available for temporary use. Direct SSH needs a reachable network or VPN.
 Nothing changes your system SSH login.
 `;
 function safeName(text) {
@@ -565,6 +1226,11 @@ async function main(args = process.argv.slice(2)) {
     relay: { type: "string" },
     "relay-url": { type: "string" },
     "cloudflare-token-file": { type: "string" },
+    "ngrok-token-file": { type: "string" },
+    "oblien-credentials-file": { type: "string" },
+    "oblien-tunnel-id": { type: "string" },
+    "relay-config": { type: "string" },
+    "directory-url": { type: "string" },
     "daemon-bin": { type: "string" },
     bind: { type: "string" },
     port: { type: "string" },
@@ -583,6 +1249,7 @@ async function main(args = process.argv.slice(2)) {
   if (values.qr && !["auto", "terminal", "browser"].includes(values.qr)) throw new Error("Choose --qr auto, terminal or browser.");
   if (values.startup && values["no-startup"]) throw new Error("Choose either --startup or --no-startup.");
   const directory = path.resolve(values["state-dir"] ?? defaultStateDirectory());
+  const discoveryOptions = { url: values["directory-url"] };
   const emit = (event, data = {}, text) => {
     if (values.json) process.stdout.write(JSON.stringify({ event, ...data }) + "\n");
     else if (text) process.stdout.write(text + "\n");
@@ -591,6 +1258,11 @@ async function main(args = process.argv.slice(2)) {
     await superviseComputer(directory);
     return;
   }
+  if (command === "_relay") {
+    if (!values["relay-config"]) throw new Error("Missing relay configuration.");
+    await runManagedRelay(path.resolve(values["relay-config"]));
+    return;
+  }
   if (command === "_watch") {
     await watchComputer(directory, fileURLToPath(import.meta.url));
     return;
@@ -602,9 +1274,20 @@ async function main(args = process.argv.slice(2)) {
     emit("startup", state, state.enabled ? "Mindwire starts after you sign in to this computer and recovers automatically." : "Automatic startup is off. Use mindwire start to run the service.");
     return;
   }
-  if (["connect", "start", "reconnect"].includes(command)) {
-    const requestedAction = command === "reconnect" ? "reconnect" : command === "connect" ? connectionAction(positionals[1]) : void 0;
+  if (command === "discovery") {
+    const action = positionals[1] ?? "status";
+    if (!["enable", "disable", "status"].includes(action)) throw new Error("Use mindwire discovery enable, disable or status.");
+    const client2 = action === "status" ? await computerClient(directory) : await ensureComputer(directory, fileURLToPath(import.meta.url), {}, void 0, { waitForRoutes: false });
+    const status = action === "enable" ? await enableAddressDiscovery({ directory, computer: client2, prompt: terminalSetupPrompt, ...discoveryOptions }) : action === "disable" ? await client2.computer.configureDiscovery(false) : await client2.computer.discovery();
+    emit("discovery", status, discoveryDescription(status));
+    if (action === "enable") emit("discovery_hint", {}, "Open each saved phone once while its current address works. Pair new phones with mindwire connect pair.");
+    return;
+  }
+  if (["connect", "start", "reconnect", "connection"].includes(command)) {
+    let requestedAction = command === "reconnect" ? "reconnect" : command === "connect" ? connectionAction(positionals[1]) : void 0;
+    let automaticDiscovery = false, addressChanged = false;
     const patch = {};
+    const previous = await readJSON(path.join(directory, "computer-config.json"));
     if (values.directory) patch.directory = path.resolve(values.directory);
     if (values.host) patch.host = values.host;
     if (values.bind) patch.bind = values.bind;
@@ -617,33 +1300,64 @@ async function main(args = process.argv.slice(2)) {
     }
     if (values["daemon-bin"] || process.env.MINDWIRE_DAEMON) patch.daemonBin = path.resolve(values["daemon-bin"] ?? process.env.MINDWIRE_DAEMON);
     if (values.version) patch.version = values.version.replace(/^v/, "");
-    if (values.relay || values["relay-url"] || values["cloudflare-token-file"]) {
+    if (values.relay || values["relay-url"] || values["cloudflare-token-file"] || values["ngrok-token-file"] || values["oblien-credentials-file"]) {
       const kind = values.relay ?? "custom";
-      if (!["none", "cloudflare", "ngrok", "custom"].includes(kind)) throw new Error("Choose relay none, cloudflare, ngrok or custom.");
+      if (!["none", "oblien", "cloudflare", "ngrok", "custom"].includes(kind)) throw new Error("Choose relay none, oblien, cloudflare, ngrok or custom.");
+      const tunnelId = values["oblien-tunnel-id"] === void 0 ? void 0 : Number(values["oblien-tunnel-id"]);
+      if (tunnelId !== void 0 && (!Number.isSafeInteger(tunnelId) || tunnelId <= 0)) throw new Error("Invalid Oblien tunnel ID.");
       patch.relay = {
         kind,
         url: values["relay-url"],
-        cloudflareTokenFile: values["cloudflare-token-file"] ? path.resolve(values["cloudflare-token-file"]) : void 0
+        cloudflareTokenFile: values["cloudflare-token-file"] ? path.resolve(values["cloudflare-token-file"]) : void 0,
+        ngrokTokenFile: values["ngrok-token-file"] ? path.resolve(values["ngrok-token-file"]) : void 0,
+        oblienCredentialsFile: values["oblien-credentials-file"] ? path.resolve(values["oblien-credentials-file"]) : void 0,
+        oblienTunnelId: tunnelId
       };
     }
+    const interactive = !values.json && !!process.stdin.isTTY;
+    const needsSetup = command === "connection" || command === "connect" && !previous && !patch.relay && interactive || patch.relay?.kind === "oblien" && !patch.relay.oblienCredentialsFile;
+    if (needsSetup) {
+      const selected = command === "connection" && positionals[1] ? connectionProvider(positionals[1]) : void 0;
+      if (!interactive && selected !== "automatic" && selected !== "temporary")
+        throw new Error("Run mindwire connection in an interactive terminal, or supply the provider's saved URL and credential-file options.");
+      const provider = selected ?? (patch.relay?.kind === "oblien" ? "oblien" : await chooseProvider(terminalSetupPrompt));
+      automaticDiscovery = provider === "automatic";
+      Object.assign(patch, await setupProvider({
+        directory,
+        provider,
+        prompt: terminalSetupPrompt,
+        config: { ...defaultComputerConfig(), ...previous, ...patch }
+      }));
+      if (!previous || connectionAddress(patch.relay ?? previous.relay, patch.host ?? previous.host) !== connectionAddress(previous.relay, previous.host)) addressChanged = true;
+    }
+    if (automaticDiscovery && previous) {
+      const running = await ensureComputer(directory, fileURLToPath(import.meta.url), {}, void 0, { waitForRoutes: false });
+      await enableAddressDiscovery({ directory, computer: running, prompt: terminalSetupPrompt, ...discoveryOptions });
+    }
     const progress = !values.json && process.stderr.isTTY && process.env.TERM !== "dumb" ? new ConnectionProgress(process.stderr) : void 0;
     emit("starting", {}, progress ? void 0 : "Starting Mindwire\u2026");
     const client2 = await ensureComputer(directory, fileURLToPath(import.meta.url), patch, (phase) => {
       if (progress) progress.update(phase);
       else emit("progress", { message: phase }, phase);
     }).finally(() => progress?.close());
+    if (automaticDiscovery && !previous) await enableAddressDiscovery({ directory, computer: client2, prompt: terminalSetupPrompt, ...discoveryOptions });
     const info = await client2.computer.info();
-    emit("ready", { computerId: info.computerId, routes: info.routes }, "Mindwire is running in the background.");
+    const savedConfig = await readJSON(path.join(directory, "computer-config.json"));
+    const connection = connectionInfo(savedConfig?.relay ?? { kind: "cloudflare" }, savedConfig?.host);
+    emit("ready", { computerId: info.computerId, routes: info.routes, connection }, "Mindwire is running in the background.");
+    emit("connection", connection, connectionDescription(connection));
     if (command === "start") return;
     if (info.routes.some((route) => route.kind === "websocket")) {
       emit("secure_connection", {}, "Your phone connects over end-to-end encrypted SSH. The tunnel carries encrypted traffic; only phones you approve can connect.");
     }
     const devices = await client2.computer.devices();
     const saved = devices.filter((device) => !device.revoked);
+    if (addressChanged && !saved.some((device) => device.addressRecovery)) requestedAction = "pair";
+    if (info.discovery?.enabled) emit("discovery", info.discovery, discoveryDescription(info.discovery));
     if (saved.length) emit("saved_devices", { devices: saved }, `
 Saved approvals on this computer
 ${deviceSummary(saved)}`);
-    const question = !values.json && process.stdin.isTTY ? async (prompt) => {
+    const question2 = !values.json && process.stdin.isTTY ? async (prompt) => {
       const input = createInterface({ input: process.stdin, output: process.stderr });
       try {
         return await input.question(prompt);
@@ -651,13 +1365,13 @@ ${deviceSummary(saved)}`);
         input.close();
       }
     } : void 0;
-    const action = await chooseConnectionAction({ requested: requestedAction, devices });
+    const action = await chooseConnectionAction({ requested: requestedAction, devices, persistent: connection.address === "persistent" });
     const startupPreference = await startupStatus(directory);
     const startupAction = await chooseStartupAction({
       state: startupPreference,
       startup: values.startup,
       noStartup: values["no-startup"],
-      question: action === "pair" && saved.length === 0 ? question : void 0
+      question: action === "pair" && saved.length === 0 ? question2 : void 0
     });
     if (startupAction !== void 0) {
       try {
@@ -671,11 +1385,12 @@ ${deviceSummary(saved)}`);
     }
     if (action === "resume") {
       const connected = saved.filter((device) => device.connected);
-      emit("connected", { computerId: info.computerId, devices: connected }, `
+      if (connected.length) emit("connected", { computerId: info.computerId, devices: connected }, `
 Connected:
 ${deviceSummary(connected)}
 Mindwire continues running in the background.`);
-      emit("connect_hint", {}, "To scan again or add a phone, run mindwire reconnect.");
+      else emit("waiting_for_phone", { computerId: info.computerId }, "\nReady for your saved phone. Open Mindwire; it will retry this computer's saved connection.");
+      emit("connect_hint", {}, "If the connection was removed from your phone, run mindwire connect pair to scan again.");
       return;
     }
     const invitation = await client2.computer.invite((await client2.computer.info()).routes);
@@ -732,12 +1447,12 @@ ${safeName(pairing.request.name)} wants to connect.
 Device key: ${fingerprint}
 Access: files and commands as your computer account.`
           );
-          if (!question) {
+          if (!question2) {
             const command2 = approvalCommand(invitation.pairingId, pairing.request.id);
             emit("approval_command", { command: command2 }, `Review this device, then run:
 ${command2}`);
           } else {
-            const decision = await choosePairingDecision({ replacements, question });
+            const decision = await choosePairingDecision({ replacements, question: question2 });
             await client2.computer.decide(
               invitation.pairingId,
               pairing.request.id,
@@ -761,21 +1476,37 @@ ${command2}`);
   const client = await computerClient(directory);
   switch (command) {
     case "status": {
-      const [info, health, work, controller, startup] = await Promise.all([
+      const [info, health, work, controller, startup, config, change] = await Promise.all([
         client.computer.info(),
         client.health(),
         client.service.updateStatus(),
         readJSON(path.join(directory, "computer-controller.json")),
-        startupStatus(directory)
+        startupStatus(directory),
+        readJSON(path.join(directory, "computer-config.json")),
+        readJSON(path.join(directory, "computer-connection-change.json"))
       ]);
+      const connection = info.connection ?? (config && connectionInfo(config.relay, config.host));
+      const connectionChange = change && { status: change.status, message: change.message };
       emit(
         "status",
-        { ...info, daemonVersion: health.version, ...work, startup, recovering: controller?.recovering, relayError: controller?.error, relayErrorCode: controller?.errorCode },
+        {
+          ...info,
+          connection,
+          daemonVersion: health.version,
+          ...work,
+          startup,
+          connectionChange,
+          recovering: controller?.recovering,
+          relayError: controller?.error,
+          relayErrorCode: controller?.errorCode
+        },
         `Mindwire ${health.version} \xB7 ${work.idle ? "idle" : "working"}
 Startup: ${startup.enabled ? "on" : "off"}
-${info.routes.map((route) => route.kind === "ssh" ? `SSH ${route.host}:${route.port}` : route.url).join("\n")}${controller?.error ? `
-${controller.error}` : ""}`
+${connection ? connectionDescription(connection) + "\n" : ""}${info.routes.map((route) => route.kind === "ssh" ? `SSH ${route.host}:${route.port}` : route.url).join("\n")}${controller?.error ? `
+${controller.error}` : ""}${change && change.status !== "complete" ? `
+Connection change: ${change.status}${change.message ? " \xB7 " + change.message : ""}` : ""}`
       );
+      if (info.discovery?.enabled && !values.json) emit("discovery", info.discovery, discoveryDescription(info.discovery));
       break;
     }
     case "devices": {