nio-cat 0.5.1 → 0.6.1

package/src/server.js

@@ -13,6 +13,7 @@ const github = require('./github');
 const { addServer, knownHosts } = require('./ssh');
 const { agentCommands } = require('./commands');
 const { pairLink, qrSvg, makeCode, codeLink } = require('./pair');
+const directory = require('./directory');
 
 // L'app web: copiada dins del paquet en publicar-lo, o l'arrel del repositori en desenvolupament.
 const WEB_DIRS = [path.join(__dirname, '..', 'web'), path.join(__dirname, '..', '..')];
@@ -42,14 +43,6 @@ function originAllowed(cfg, origin) {
   });
 }
 
-function tokenOk(cfg, req) {
-  const h = req.headers.authorization || '';
-  const t = h.startsWith('Bearer ') ? h.slice(7) : '';
-  const a = Buffer.from(t);
-  const b = Buffer.from(cfg.token);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-
 function isLoopbackDirect(req) {
   const ip = req.socket.remoteAddress || '';
   const local = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
@@ -141,26 +134,53 @@ function listDir(cfg, raw) {
 // Noms de model d'Ollama: «qwen3:4b», «hf.co/usuari/model:Q4_K_M»…
 const MODEL_NAME = /^[\w][\w.\-/]{0,100}(:[\w.\-]{1,60})?$/;
 
-function createServer({ cfg, hub, getPublicUrl, getApp }) {
-  const streams = new Set();
+// Rutes que afegeixen altres mòduls (memòria, feines, Telegram, veu, navegador…).
+// Cada ruta: { method, path: RegExp|string, handler: async ({ req, res, url, params, body, device }), raw?, limit? }.
+function matchRoute(routes, method, p) {
+  for (const r of routes) {
+    if (r.method !== method) continue;
+    if (typeof r.path === 'string') {
+      if (r.path === p) return { r, params: [] };
+    } else {
+      const m = p.match(r.path);
+      if (m) return { r, params: m.slice(1).map((x) => decodeURIComponent(x)) };
+    }
+  }
+  return null;
+}
+
+function createServer({ cfg, hub, auth, audit, getPublicUrl, getApp, routes = [], info = () => ({}) }) {
+  const streams = new Map(); // res -> id del dispositiu
+  auth.onRevoke((d) => {
+    for (const [res, dev] of streams) if (dev === d.id) { res.end(); streams.delete(res); }
+    const before = (cfg.pushSubs || []).length;
+    cfg.pushSubs = (cfg.pushSubs || []).filter((x) => x.device !== d.id);
+    if (cfg.pushSubs.length !== before) save(cfg);
+  });
   const seenDevices = new Map(); // mòbils que s'han connectat (per avisar l'ordinador que mostra el QR)
   const pulls = new Map(); // descàrregues de models d'Ollama en curs
 
   hub.on('out', (msg) => {
     const data = `data: ${JSON.stringify(msg)}\n\n`;
-    for (const res of streams) res.write(data);
+    for (const res of streams.keys()) res.write(data);
   });
   setInterval(() => {
-    for (const res of streams) res.write(': ping\n\n');
+    for (const res of streams.keys()) res.write(': ping\n\n');
   }, 15000).unref();
 
   const hookUrl = () => `http://127.0.0.1:${cfg.port}/internal/approval`;
 
-  async function api(req, res, url) {
+  async function api(req, res, url, device) {
     const p = url.pathname;
     const m = (re) => p.match(re);
     const method = req.method;
 
+    const hit = matchRoute(routes, method, p);
+    if (hit) {
+      const body = method === 'GET' || method === 'DELETE' || hit.r.raw ? undefined : await readBody(req, hit.r.limit);
+      return hit.r.handler({ req, res, url, params: hit.params, body, device });
+    }
+
     if (p === '/api/info' && method === 'GET') {
       return {
         name: 'nio',
@@ -173,8 +193,32 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         roots: cfg.roots,
         vapidKey: cfg.vapid.publicKey,
         id: cfg.id,
+        device: { id: device.id, name: device.name, primary: !!device.primary },
+        identity: directory.identity(cfg),
+        ...(await info()),
       };
     }
+    if (p === '/api/devices' && method === 'GET') return auth.list(device.id);
+    let dv;
+    if ((dv = m(/^\/api\/devices\/([\w-]+)$/))) {
+      if (method === 'PATCH') {
+        const b = await readBody(req);
+        const r = auth.rename(dv[1], b.name);
+        if (!r) throw httpErr(404, 'Aquest dispositiu no existeix');
+        return r;
+      }
+      if (method === 'DELETE') {
+        const r = auth.revoke(dv[1]);
+        if (!r) throw httpErr(404, 'Aquest dispositiu no existeix');
+        audit.add({ type: 'device', what: `Accés revocat: ${r.name}`, by: device.name });
+        return r;
+      }
+    }
+    if (p === '/api/audit' && method === 'GET') {
+      const limit = Math.min(1000, Number(url.searchParams.get('limit')) || 200);
+      const type = url.searchParams.get('type');
+      return audit.recent(limit, type ? (e) => e.type === type : null);
+    }
     if (p === '/api/ssh/hosts' && method === 'GET') return knownHosts();
     if (p === '/api/projects' && method === 'GET') return listProjects(cfg);
     if (p === '/api/fs' && method === 'GET') return listDir(cfg, url.searchParams.get('path'));
@@ -236,9 +280,11 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
       // Enllaç i QR per connectar un altre dispositiu (el mòbil) amb aquest ordinador.
       const pub = getPublicUrl();
       if (!pub || /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:|\/|$)/i.test(pub)) return { link: null };
-      const link = pairLink(getApp ? getApp() : cfg.app, pub, cfg.token);
-      const code = makeCode(pub, cfg.token);
-      return { link, code, svg: qrSvg(codeLink(getApp ? getApp() : cfg.app, code)), url: pub, lan: /^http:\/\//.test(pub) };
+      // Un secret d'un sol ús (no la clau principal): el mòbil el canvia per una clau pròpia i revocable.
+      const { code: secret, expires } = auth.createCode({ secret: true });
+      const link = pairLink(getApp ? getApp() : cfg.app, pub, secret);
+      const code = makeCode(pub, secret);
+      return { link, code, svg: qrSvg(codeLink(getApp ? getApp() : cfg.app, code)), url: pub, lan: /^http:\/\//.test(pub), expires };
     }
     if (p === '/api/github' && method === 'GET') return github.status();
     if (p === '/api/github/repos' && method === 'GET') return github.repos(url.searchParams.get('owner') || '');
@@ -293,7 +339,7 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
     if (p === '/api/approvals' && method === 'GET') return hub.pendingApprovals();
     if ((r = m(/^\/api\/approvals\/([\w-]+)$/)) && method === 'POST') {
       const b = await readBody(req);
-      const a = hub.decide(r[1], b.decision === 'allow' ? 'allow' : 'deny', b.reason);
+      const a = hub.decide(r[1], b.decision === 'allow' ? 'allow' : 'deny', b.reason, device.name);
       if (!a) throw httpErr(404, 'Aquesta petició ja s’ha resolt');
       return a;
     }
@@ -301,9 +347,10 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
     if (p === '/api/push' && method === 'POST') {
       const b = await readBody(req);
       if (!b.endpoint || !/^https:\/\//.test(b.endpoint)) throw httpErr(400, 'La subscripció als avisos no és vàlida');
+      const keys = b.keys && typeof b.keys.p256dh === 'string' && typeof b.keys.auth === 'string' ? { p256dh: b.keys.p256dh.slice(0, 200), auth: b.keys.auth.slice(0, 100) } : null;
       cfg.pushSubs = (cfg.pushSubs || []).filter((x) => x.endpoint !== b.endpoint);
-      cfg.pushSubs.push({ endpoint: b.endpoint, added: Date.now() });
-      cfg.pushSubs = cfg.pushSubs.slice(-10);
+      cfg.pushSubs.push({ endpoint: String(b.endpoint).slice(0, 1000), keys, device: device.id, added: Date.now() });
+      cfg.pushSubs = cfg.pushSubs.slice(-20);
       save(cfg);
       return { ok: true };
     }
@@ -376,11 +423,26 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
       return res.end(JSON.stringify({ nio: true, id: cfg.id, name: os.hostname() }));
     }
 
-    if (url.pathname.startsWith('/api/')) {
-      if (!tokenOk(cfg, req)) {
-        res.writeHead(401, { 'content-type': 'application/json' });
-        return res.end(JSON.stringify({ error: 'La clau no és vàlida. Torna a connectar el mòbil amb el codi QR.' }));
+    const json = (status, obj) => {
+      res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      res.end(JSON.stringify(obj));
+    };
+
+    // Aparellament: canvia un codi d'un sol ús per una clau pròpia d'aquest dispositiu. No demana clau.
+    if (url.pathname === '/api/pair' && req.method === 'POST') {
+      try {
+        const b = await readBody(req, 4096);
+        const r = auth.redeem(b.code, b.name);
+        audit.add({ type: 'device', what: `Dispositiu aparellat: ${r.device.name}`, by: r.device.name });
+        return json(200, { ...r, id: cfg.id, host: os.hostname(), identity: directory.identity(cfg) });
+      } catch (e) {
+        return json(e.status || 500, { error: e.message });
       }
+    }
+
+    if (url.pathname.startsWith('/api/')) {
+      const device = auth.fromRequest(req);
+      if (!device) return json(401, { error: 'Aquest dispositiu no té accés (o l’has revocat). Torna a aparellar-lo amb un codi nou.' });
       if (url.pathname === '/api/stream') {
         res.writeHead(200, {
           'content-type': 'text/event-stream; charset=utf-8',
@@ -392,10 +454,10 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         const dev = String(url.searchParams.get('d') || '').slice(0, 40), kind = url.searchParams.get('k') === 'phone' ? 'phone' : 'desktop';
         if (dev && kind === 'phone' && Date.now() - (seenDevices.get(dev) || 0) > 10 * 60 * 1000) {
           const data = `data: ${JSON.stringify({ type: 'device', device: dev, kind })}\n\n`;
-          for (const o of streams) o.write(data);
+          for (const o of streams.keys()) o.write(data);
         }
         if (dev) seenDevices.set(dev, Date.now());
-        streams.add(res);
+        streams.set(res, device.id);
         req.on('close', () => streams.delete(res));
         return;
       }
@@ -414,12 +476,12 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
         return res.end();
       }
       try {
-        const out = await api(req, res, url);
-        res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
-        res.end(JSON.stringify(out));
+        const out = await api(req, res, url, device);
+        if (res.headersSent) return; // la ruta ja ha respost (p. ex. àudio o imatges)
+        json(200, out);
       } catch (e) {
-        res.writeHead(e.status || 500, { 'content-type': 'application/json; charset=utf-8' });
-        res.end(JSON.stringify({ error: e.message }));
+        if (res.headersSent) return res.end();
+        json(e.status || 500, { error: e.message });
       }
       return;
     }
@@ -433,4 +495,4 @@ function createServer({ cfg, hub, getPublicUrl, getApp }) {
   return server;
 }
 
-module.exports = { createServer, originAllowed };
+module.exports = { createServer, originAllowed, readBody };

package/src/service.js

@@ -0,0 +1,123 @@
+'use strict';
+// Servei del sistema perquè nio arrenqui sol amb l'ordinador (systemd a Linux, launchd a macOS).
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { HOME } = require('./config');
+const { searchPath } = require('./proc');
+
+const LABEL = 'cat.nio.daemon';
+
+function entry() {
+  return fs.realpathSync(path.join(__dirname, '..', 'bin', 'nio.js'));
+}
+
+function q(s) {
+  // Cometes per a ExecStart de systemd.
+  return /[\s"\\]/.test(s) ? `"${String(s).replace(/(["\\])/g, '\\$1')}"` : s;
+}
+
+function systemdUnit({ roots, system }) {
+  const env = [`PATH=${searchPath().join(':')}`, process.env.NIO_HOME ? `NIO_HOME=${process.env.NIO_HOME}` : null].filter(Boolean);
+  return `[Unit]
+Description=nio · els teus agents, des del mòbil
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${[process.execPath, entry(), '--no-open', ...roots].map(q).join(' ')}
+WorkingDirectory=${roots[0] || os.homedir()}
+${env.map((e) => `Environment=${q(e)}`).join('\n')}
+Environment=NO_COLOR=1
+Restart=always
+RestartSec=3
+${system ? `User=${os.userInfo().username}\n` : ''}
+[Install]
+WantedBy=${system ? 'multi-user.target' : 'default.target'}
+`;
+}
+
+function launchdPlist({ roots }) {
+  const x = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;');
+  const args = [process.execPath, entry(), '--no-open', ...roots].map((a) => `    <string>${x(a)}</string>`).join('\n');
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>WorkingDirectory</key><string>${x(roots[0] || os.homedir())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${x(searchPath().join(':'))}</string>
+    <key>NO_COLOR</key><string>1</string>${process.env.NIO_HOME ? `\n    <key>NIO_HOME</key><string>${x(process.env.NIO_HOME)}</string>` : ''}
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${x(path.join(HOME, 'nio.log'))}</string>
+  <key>StandardErrorPath</key><string>${x(path.join(HOME, 'nio.log'))}</string>
+</dict>
+</plist>
+`;
+}
+
+function sh(cmd, args) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8' });
+  return { ok: r.status === 0, out: `${r.stdout || ''}${r.stderr || ''}`.trim() };
+}
+
+function install({ roots, log = console.log }) {
+  if (entry().includes(`${path.sep}_npx${path.sep}`)) {
+    log('  Avís: nio s’executa des de la memòria cau de npx, que es pot esborrar.');
+    log('  Per a un servei estable, instal·la’l primer: npm install -g https://www.nio.cat/nio.tgz\n');
+  }
+  if (process.platform === 'darwin') {
+    const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    sh('launchctl', ['unload', file]);
+    fs.writeFileSync(file, launchdPlist({ roots }));
+    const r = sh('launchctl', ['load', '-w', file]);
+    if (!r.ok) throw new Error(`launchctl no l’ha pogut carregar: ${r.out}`);
+    return { file, logs: `tail -f ${path.join(HOME, 'nio.log')}` };
+  }
+  if (process.platform !== 'linux') throw new Error('El servei automàtic només funciona a Linux (systemd) i macOS (launchd).');
+  if (!sh('systemctl', ['--version']).ok) throw new Error('Aquest sistema no té systemd.');
+  const system = process.getuid && process.getuid() === 0;
+  const file = system ? '/etc/systemd/system/nio.service' : path.join(os.homedir(), '.config', 'systemd', 'user', 'nio.service');
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, systemdUnit({ roots, system }));
+  const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
+  sh(ctl[0], [...ctl.slice(1), 'daemon-reload']);
+  const r = sh(ctl[0], [...ctl.slice(1), 'enable', '--now', 'nio.service']);
+  if (!r.ok) throw new Error(`systemctl no l’ha pogut engegar: ${r.out}`);
+  sh(ctl[0], [...ctl.slice(1), 'restart', 'nio.service']);
+  let linger = null;
+  if (!system) {
+    // Sense «linger», el servei d'usuari s'atura quan tanques la sessió (i no arrenca en reiniciar).
+    linger = sh('loginctl', ['enable-linger', os.userInfo().username]).ok;
+  }
+  return { file, linger, logs: system ? 'journalctl -u nio -f' : 'journalctl --user -u nio -f' };
+}
+
+function uninstall() {
+  if (process.platform === 'darwin') {
+    const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+    sh('launchctl', ['unload', '-w', file]);
+    fs.rmSync(file, { force: true });
+    return file;
+  }
+  const system = process.getuid && process.getuid() === 0;
+  const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
+  sh(ctl[0], [...ctl.slice(1), 'disable', '--now', 'nio.service']);
+  const file = system ? '/etc/systemd/system/nio.service' : path.join(os.homedir(), '.config', 'systemd', 'user', 'nio.service');
+  fs.rmSync(file, { force: true });
+  sh(ctl[0], [...ctl.slice(1), 'daemon-reload']);
+  return file;
+}
+
+module.exports = { install, uninstall, systemdUnit, launchdPlist };

package/src/tunnel.js

@@ -1,49 +1,165 @@
 'use strict';
-// Túnel gratuït amb Cloudflare (quick tunnel, sense compte):
-// el mòbil arriba al daemon des de qualsevol xarxa i sense obrir ports.
-const { spawn } = require('child_process');
+// Túnels de Cloudflare.
+// · Túnel amb nom (named tunnel): adreça fixa (p. ex. https://vps.nio.cat). Cal un compte de
+//   Cloudflare i que la zona DNS del domini sigui a Cloudflare. Es configura un cop amb
+//   `nio tunnel setup <host>` i a partir d'aquí el mòbil s'hi torna a connectar sol.
+// · Quick tunnel: sense compte, però l'adreça (…trycloudflare.com) canvia a cada reinici.
+//   És l'opció de reserva.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
 const { which, childEnv } = require('./proc');
+const { HOME } = require('./config');
 
+const HOST_RE = /^(?=.{4,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const NAME_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/i;
+
+// Manté cloudflared engegat: si cau, el torna a obrir amb una espera creixent.
+function supervise(bin, args, { onLine, onExit } = {}) {
+  let child = null;
+  let stopped = false;
+  let tries = 0;
+  const open = () => {
+    const startedAt = Date.now();
+    child = spawn(bin, args, { env: childEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+    const scan = (d) => String(d).split('\n').forEach((l) => l && onLine && onLine(l));
+    child.stdout.on('data', scan);
+    child.stderr.on('data', scan);
+    child.on('error', () => {});
+    child.on('close', (code) => {
+      if (stopped) return;
+      if (Date.now() - startedAt > 60000) tries = 0;
+      const wait = Math.min(60000, 2000 * 2 ** tries++);
+      if (onExit) onExit(code, wait);
+      setTimeout(() => !stopped && open(), wait).unref();
+    });
+  };
+  open();
+  const stop = () => {
+    stopped = true;
+    try { child && child.kill(); } catch { /* ja ha acabat */ }
+  };
+  process.on('exit', stop);
+  return { stop, get child() { return child; } };
+}
+
+// Quick tunnel: l'adreça arriba pel registre de cloudflared. Si es reinicia, n'arriba una altra.
 function startTunnel(port, onUrl) {
   const bin = which('cloudflared');
   if (!bin) return null;
-  const child = spawn(bin, ['tunnel', '--no-autoupdate', '--url', `http://127.0.0.1:${port}`], {
-    env: childEnv(),
-    stdio: ['ignore', 'pipe', 'pipe'],
+  let last = null;
+  return supervise(bin, ['tunnel', '--no-autoupdate', '--url', `http://127.0.0.1:${port}`], {
+    onLine: (l) => {
+      const m = l.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
+      if (m && m[0] !== last) {
+        last = m[0];
+        onUrl(m[0]);
+      }
+    },
   });
-  let found = false;
-  const scan = (d) => {
-    const m = String(d).match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
-    if (m && !found) {
-      found = true;
-      onUrl(m[0]);
-    }
-  };
-  child.stdout.on('data', scan);
-  child.stderr.on('data', scan);
-  process.on('exit', () => child.kill());
-  return child;
 }
 
-// Túnel amb nom (compte gratuït de Cloudflare): l'adreça no canvia entre reinicis.
-function startNamedTunnel(token, onReady) {
+// Túnel amb nom configurat amb «nio tunnel setup»: l'adreça és fixa i ja la sabem abans d'obrir-lo.
+function startConfiguredTunnel(t, port, { onReady, onDown } = {}) {
   const bin = which('cloudflared');
   if (!bin) return null;
-  const child = spawn(bin, ['tunnel', '--no-autoupdate', 'run', '--token', token], {
-    env: childEnv(),
-    stdio: ['ignore', 'pipe', 'pipe'],
+  const file = writeConfig(t, port);
+  let ready = false;
+  return supervise(bin, ['tunnel', '--no-autoupdate', '--config', file, 'run', t.id || t.name], {
+    onLine: (l) => {
+      if (!ready && /Registered tunnel connection/i.test(l)) {
+        ready = true;
+        onReady && onReady();
+      }
+    },
+    onExit: (code, wait) => {
+      ready = false;
+      onDown && onDown(code, wait);
+    },
   });
+}
+
+function configFile() {
+  return path.join(HOME, 'cloudflared.yml');
+}
+
+function writeConfig(t, port) {
+  const yml = [
+    '# Generat per nio. Es torna a escriure a cada arrencada.',
+    `tunnel: ${t.id || t.name}`,
+    t.credentials ? `credentials-file: ${t.credentials}` : null,
+    'ingress:',
+    `  - hostname: ${t.host}`,
+    `    service: http://127.0.0.1:${port}`,
+    '  - service: http_status:404',
+    '',
+  ].filter((x) => x !== null).join('\n');
+  fs.writeFileSync(configFile(), yml, { mode: 0o600 });
+  return configFile();
+}
+
+// Busca l'identificador d'un túnel que ja existeix.
+function findTunnel(bin, name) {
+  const r = spawnSync(bin, ['tunnel', 'list', '--output', 'json', '--name', name], { env: childEnv(), encoding: 'utf8' });
+  if (r.status !== 0) return null;
+  try {
+    const list = JSON.parse(r.stdout || '[]');
+    const t = list.find((x) => x.name === name && !x.deleted_at);
+    return t ? t.id : null;
+  } catch {
+    return null;
+  }
+}
+
+// Configuració d'un sol cop: login → create → route dns. Tot passa al compte de Cloudflare
+// de l'usuari i amb les seves credencials (~/.cloudflared). nio només en desa el nom i l'host.
+function setupNamedTunnel({ host, name, log = console.log }) {
+  const bin = which('cloudflared');
+  if (!bin) throw new Error('Falta cloudflared. Instal·la’l primer (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/).');
+  if (!HOST_RE.test(host || '')) throw new Error(`«${host}» no és un nom de domini vàlid (p. ex. vps.nio.cat)`);
+  name = name || `nio-${host.split('.')[0]}`;
+  if (!NAME_RE.test(name)) throw new Error(`«${name}» no és un nom de túnel vàlid`);
+  const run = (args, inherit) => spawnSync(bin, args, { env: childEnv(), stdio: inherit ? 'inherit' : 'pipe', encoding: 'utf8' });
+
+  const cert = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+  if (!fs.existsSync(cert)) {
+    log('\n  1/3 · Inicia la sessió a Cloudflare. S’obrirà (o et mostrarà) un enllaç: tria la zona del domini.\n');
+    const r = run(['tunnel', 'login'], true);
+    if (r.status !== 0) throw new Error('No s’ha pogut iniciar la sessió a Cloudflare');
+  } else log('  1/3 · Ja hi ha una sessió de Cloudflare en aquest ordinador.');
+
+  let id = findTunnel(bin, name);
+  if (!id) {
+    log(`  2/3 · Creo el túnel «${name}»…`);
+    const r = run(['tunnel', 'create', name]);
+    const m = `${r.stdout}${r.stderr}`.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);
+    id = m ? m[0] : findTunnel(bin, name);
+    if (r.status !== 0 || !id) throw new Error(`cloudflared no ha pogut crear el túnel:\n${r.stderr || r.stdout}`);
+  } else log(`  2/3 · El túnel «${name}» ja existeix (${id}).`);
+
+  log(`  3/3 · Apunto ${host} cap al túnel (registre CNAME a Cloudflare)…`);
+  const r = run(['tunnel', 'route', 'dns', name, host]);
+  if (r.status !== 0 && !/already exists|already configured/i.test(`${r.stderr}${r.stdout}`)) {
+    throw new Error(`No s’ha pogut crear el registre DNS de ${host}:\n${r.stderr || r.stdout}\nComprova que la zona del domini és al teu compte de Cloudflare.`);
+  }
+  const credentials = path.join(os.homedir(), '.cloudflared', `${id}.json`);
+  return { mode: 'named', name, id, host: host.toLowerCase(), credentials: fs.existsSync(credentials) ? credentials : null };
+}
+
+// Túnel amb nom creat al tauler de Cloudflare (nio --tunnel-token … --url https://…).
+function startNamedTunnel(token, onReady) {
+  const bin = which('cloudflared');
+  if (!bin) return null;
   let ready = false;
-  const scan = (d) => {
-    if (!ready && /Registered tunnel connection/i.test(String(d))) {
-      ready = true;
-      onReady();
-    }
-  };
-  child.stdout.on('data', scan);
-  child.stderr.on('data', scan);
-  process.on('exit', () => child.kill());
-  return child;
+  return supervise(bin, ['tunnel', '--no-autoupdate', 'run', '--token', token], {
+    onLine: (l) => {
+      if (!ready && /Registered tunnel connection/i.test(l)) {
+        ready = true;
+        onReady();
+      }
+    },
+  });
 }
 
-module.exports = { startTunnel, startNamedTunnel };
+module.exports = { startTunnel, startNamedTunnel, startConfiguredTunnel, setupNamedTunnel, writeConfig, HOST_RE };