onedeploy-cli 0.1.10 → 0.1.11

package/dist/browser.js

@@ -9,12 +9,7 @@ export const openBrowser = async (url) => {
             case "linux": {
                 if (isRoot && sudoUser) {
                     // Run as the original user to avoid browser sandbox issues
-                    await promisify(execFile)("sudo", [
-                        "-u",
-                        sudoUser,
-                        "xdg-open",
-                        url,
-                    ]);
+                    await promisify(execFile)("sudo", ["-u", sudoUser, "xdg-open", url]);
                 }
                 else {
                     await promisify(execFile)("xdg-open", [url]);

package/dist/index.js

@@ -1,7 +1,33 @@
 #!/usr/bin/env node
 import prompts from "prompts";
 import { loadConfig, saveConfig } from "./config.js";
-import { cleanupNebula, connectNebula, installNebula, isNebulaRunning, } from "./nebula.js";
+import { cleanupNebula, getSession, installNebula, isNebulaRunning, startNebula, stopNebula, } from "./nebula.js";
+import { deleteAllTunnels } from "./tunnel.js";
+import { tunnelMenu } from "./tunnel-menu.js";
+// Track active connection for cleanup on signals
+let activeConnection = null;
+const cleanup = async () => {
+    if (activeConnection) {
+        console.log("\nCleaning up...");
+        try {
+            await deleteAllTunnels(activeConnection.instance, activeConnection.session);
+        }
+        catch {
+            // ignore if already disconnected
+        }
+        activeConnection.stopRefresh();
+        stopNebula(activeConnection.nebulaProcess);
+        activeConnection = null;
+    }
+    await cleanupNebula();
+};
+const handleSignal = () => {
+    if (!isNebulaRunning) {
+        process.exit();
+    }
+    // Perform cleanup and exit
+    cleanup().finally(() => process.exit());
+};
 if (process.argv.includes("--version")) {
     console.log("onedeploy-cli version 0.1.4");
     process.exit();
@@ -109,9 +135,30 @@ const mainMenu = async () => {
     else {
         urlToConnect = selection;
     }
-    // Connect first
     const instance = { url: urlToConnect, apiKey: "" };
-    await connectNebula(instance);
+    // 1. Authenticate
+    const session = await getSession(instance);
+    // 2. Start Nebula (non-blocking)
+    const { nebulaProcess, stopRefresh } = await startNebula(instance, session);
+    // Track connection for signal handlers
+    activeConnection = { instance, session, nebulaProcess, stopRefresh };
+    // 3. Enter tunnel management loop
+    try {
+        await tunnelMenu(instance, session);
+    }
+    finally {
+        // 4. Cleanup on exit
+        console.log("Cleaning up tunnels...");
+        try {
+            await deleteAllTunnels(instance, session);
+        }
+        catch {
+            // ignore if already disconnected
+        }
+        stopRefresh();
+        stopNebula(nebulaProcess);
+        activeConnection = null;
+    }
     // Only save if connection was successful (didn't throw)
     await addInstance(urlToConnect);
     return true;
@@ -120,8 +167,11 @@ process.on("SIGINT", () => {
     if (!isNebulaRunning) {
         process.exit();
     }
-    // ignore SIGINTs to continue after Nebula is disconnected
+    // When Nebula is running, let prompts handle SIGINT (returns undefined)
+    // which triggers the finally block in mainMenu
 });
+process.on("SIGTERM", handleSignal);
+process.on("SIGHUP", handleSignal);
 await installNebula();
 try {
     while (true) {
@@ -132,5 +182,5 @@ try {
     }
 }
 finally {
-    await cleanupNebula();
+    await cleanup();
 }

package/dist/nebula.js

@@ -107,6 +107,10 @@ export const getNebulaCert = async (instance, session) => {
         `${tmpDir}/nebula-debug.crt`,
     ]);
     const cert = JSON.parse(stdout);
+    // Extract Nebula IP from certificate (remove CIDR suffix)
+    if (cert.details.networks && cert.details.networks.length > 0) {
+        nebulaIp = cert.details.networks[0].split("/")[0];
+    }
     // in case our local time isn't correct, wait for the certificate to become valid
     const validFromDate = new Date(cert.details.notBefore);
     if (validFromDate.toString() === "Invalid Date") {
@@ -119,7 +123,8 @@ export const getNebulaCert = async (instance, session) => {
     }
 };
 export let isNebulaRunning = false;
-const getSession = (instance) => {
+export let nebulaIp = null;
+export const getSession = (instance) => {
     return new Promise((resolve) => {
         const getServerAddr = () => {
             const addr = server.address();
@@ -165,17 +170,21 @@ const getSession = (instance) => {
         server.listen();
     });
 };
-export const connectNebula = async (instance) => {
-    const session = await getSession(instance);
+export const startNebula = async (instance, session) => {
     await getNebulaCert(instance, session);
     isNebulaRunning = true;
-    const nebula = spawn(`${nebulaDir}/nebula`, ["-config", `${tmpDir}/nebula.yml`], { stdio: "inherit" });
+    const nebula = spawn(`${nebulaDir}/nebula`, ["-config", `${tmpDir}/nebula.yml`], { stdio: "ignore" });
     const interval = setInterval(async () => {
         // refresh Nebula cert every 10 minutes (lifetime is 15 minutes)
         await getNebulaCert(instance, session);
         nebula.kill("SIGHUP");
     }, 10 * 60 * 1000);
-    await new Promise((resolve) => nebula.on("exit", resolve));
+    return {
+        nebulaProcess: nebula,
+        stopRefresh: () => clearInterval(interval),
+    };
+};
+export const stopNebula = (nebulaProcess) => {
+    nebulaProcess.kill("SIGTERM");
     isNebulaRunning = false;
-    clearInterval(interval);
 };

package/dist/proxy.js

@@ -0,0 +1,69 @@
+import { createServer, Socket } from "node:net";
+// Track active proxies by port
+const activeProxies = new Map();
+const connectToLocalhost = (port, clientSocket) => {
+    const targetSocket = new Socket();
+    const tryConnect = (host, fallback) => {
+        targetSocket.connect(port, host, () => {
+            clientSocket.pipe(targetSocket);
+            targetSocket.pipe(clientSocket);
+        });
+        targetSocket.once("error", (err) => {
+            if (err.code === "ECONNREFUSED" && fallback) {
+                // Try fallback address
+                targetSocket.removeAllListeners();
+                const fallbackSocket = new Socket();
+                fallbackSocket.connect(port, fallback, () => {
+                    clientSocket.pipe(fallbackSocket);
+                    fallbackSocket.pipe(clientSocket);
+                });
+                fallbackSocket.on("error", () => clientSocket.destroy());
+                clientSocket.on("error", () => fallbackSocket.destroy());
+                clientSocket.on("close", () => fallbackSocket.destroy());
+                fallbackSocket.on("close", () => clientSocket.destroy());
+            }
+            else {
+                clientSocket.destroy();
+            }
+        });
+    };
+    tryConnect("127.0.0.1", "::1");
+    clientSocket.on("error", () => targetSocket.destroy());
+    clientSocket.on("close", () => targetSocket.destroy());
+    targetSocket.on("close", () => clientSocket.destroy());
+};
+export const startProxy = (port, bindIp) => {
+    return new Promise((resolve) => {
+        const server = createServer((clientSocket) => {
+            connectToLocalhost(port, clientSocket);
+        });
+        server.on("error", (err) => {
+            if (err.code === "EADDRINUSE") {
+                // App already binds to this IP, no proxy needed
+                resolve(false);
+            }
+            else {
+                // Other error, log and continue without proxy
+                console.error(`Proxy error on port ${port}: ${err.message}`);
+                resolve(false);
+            }
+        });
+        server.listen(port, bindIp, () => {
+            activeProxies.set(port, server);
+            resolve(true);
+        });
+    });
+};
+export const stopProxy = (port) => {
+    const server = activeProxies.get(port);
+    if (server) {
+        server.close();
+        activeProxies.delete(port);
+    }
+};
+export const stopAllProxies = () => {
+    for (const [port, server] of activeProxies) {
+        server.close();
+        activeProxies.delete(port);
+    }
+};

package/dist/tunnel-menu.js

@@ -0,0 +1,169 @@
+import prompts from "prompts";
+import { createTunnel, deleteAllTunnels, deleteTunnel, getActiveTunnels, validateName, validatePort, } from "./tunnel.js";
+const MENU_CREATE = "create";
+const MENU_DELETE = "delete";
+const MENU_DELETE_ALL = "delete_all";
+const MENU_DISCONNECT = "disconnect";
+const displayActiveTunnels = () => {
+    const tunnels = getActiveTunnels();
+    console.log("\n--- Active Tunnels ---");
+    if (tunnels.length === 0) {
+        console.log("  (no active tunnels)");
+    }
+    else {
+        for (const tunnel of tunnels) {
+            const nameDisplay = tunnel.name ? ` (${tunnel.name})` : "";
+            console.log(`  https://${tunnel.hostname}${nameDisplay} → localhost:${tunnel.port}`);
+        }
+    }
+    console.log("");
+};
+const createTunnelPrompt = async (instance, session) => {
+    const { port } = await prompts({
+        type: "number",
+        name: "port",
+        message: "Enter port number",
+        validate: (value) => {
+            const error = validatePort(value);
+            return error ?? true;
+        },
+    });
+    if (port === undefined) {
+        return;
+    }
+    const { name } = await prompts({
+        type: "text",
+        name: "name",
+        message: "Enter tunnel name (optional, press Enter to skip)",
+        validate: (value) => {
+            if (!value)
+                return true;
+            const error = validateName(value);
+            return error ?? true;
+        },
+    });
+    if (name === undefined) {
+        return;
+    }
+    try {
+        await createTunnel(instance, session, port, name || undefined);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            console.error(`\nFailed to create tunnel: ${error.message}`);
+        }
+        else {
+            console.error("\nFailed to create tunnel");
+        }
+    }
+};
+const deleteTunnelPrompt = async (instance, session) => {
+    const tunnels = getActiveTunnels();
+    if (tunnels.length === 0) {
+        console.log("\nNo tunnels to delete.");
+        return;
+    }
+    const { tunnelId } = await prompts({
+        type: "select",
+        name: "tunnelId",
+        message: "Select tunnel to delete",
+        choices: tunnels.map((tunnel) => {
+            const nameDisplay = tunnel.name ? ` (${tunnel.name})` : "";
+            return {
+                title: `https://${tunnel.hostname}${nameDisplay} → localhost:${tunnel.port}`,
+                value: tunnel.id,
+            };
+        }),
+    });
+    if (tunnelId === undefined) {
+        return;
+    }
+    const { confirm } = await prompts({
+        type: "confirm",
+        name: "confirm",
+        message: "Are you sure you want to delete this tunnel?",
+        initial: false,
+    });
+    if (confirm !== true) {
+        return;
+    }
+    try {
+        await deleteTunnel(instance, session, tunnelId);
+        console.log("\nTunnel deleted.");
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            console.error(`\nFailed to delete tunnel: ${error.message}`);
+        }
+        else {
+            console.error("\nFailed to delete tunnel");
+        }
+    }
+};
+const deleteAllTunnelsPrompt = async (instance, session) => {
+    const tunnels = getActiveTunnels();
+    if (tunnels.length === 0) {
+        console.log("\nNo tunnels to delete.");
+        return;
+    }
+    const { confirm } = await prompts({
+        type: "confirm",
+        name: "confirm",
+        message: `Are you sure you want to delete all ${tunnels.length} tunnel(s)?`,
+        initial: false,
+    });
+    if (confirm !== true) {
+        return;
+    }
+    try {
+        await deleteAllTunnels(instance, session);
+        console.log("\nAll tunnels deleted.");
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            console.error(`\nFailed to delete tunnels: ${error.message}`);
+        }
+        else {
+            console.error("\nFailed to delete tunnels");
+        }
+    }
+};
+export const tunnelMenu = async (instance, session) => {
+    while (true) {
+        displayActiveTunnels();
+        const tunnels = getActiveTunnels();
+        const { action } = await prompts({
+            type: "select",
+            name: "action",
+            message: "Tunnel Management",
+            choices: [
+                { title: "Create new tunnel", value: MENU_CREATE },
+                {
+                    title: "Delete a tunnel",
+                    value: MENU_DELETE,
+                    disabled: tunnels.length === 0,
+                },
+                {
+                    title: "Delete all tunnels",
+                    value: MENU_DELETE_ALL,
+                    disabled: tunnels.length === 0,
+                },
+                { title: "Disconnect from Nebula", value: MENU_DISCONNECT },
+            ],
+        });
+        if (action === undefined || action === MENU_DISCONNECT) {
+            return;
+        }
+        switch (action) {
+            case MENU_CREATE:
+                await createTunnelPrompt(instance, session);
+                break;
+            case MENU_DELETE:
+                await deleteTunnelPrompt(instance, session);
+                break;
+            case MENU_DELETE_ALL:
+                await deleteAllTunnelsPrompt(instance, session);
+                break;
+        }
+    }
+};

package/dist/tunnel.js

@@ -0,0 +1,76 @@
+import { nebulaIp } from "./nebula.js";
+import { startProxy, stopAllProxies, stopProxy } from "./proxy.js";
+// In-memory list of active tunnels
+let activeTunnels = [];
+export const getActiveTunnels = () => {
+    return [...activeTunnels];
+};
+export const createTunnel = async (instance, session, port, name) => {
+    const body = { port };
+    if (name) {
+        body.name = name;
+    }
+    const response = await fetch(`${instance.url}/api/tunnels`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${session}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to create tunnel: ${response.status} ${errorText}`);
+    }
+    const tunnel = (await response.json());
+    tunnel.port = port; // Ensure port is set even if API doesn't return it
+    activeTunnels.push(tunnel);
+    // Try to start IPv6→IPv4 proxy on the Nebula interface
+    if (nebulaIp) {
+        await startProxy(port, nebulaIp);
+    }
+    return tunnel;
+};
+export const deleteTunnel = async (instance, session, id) => {
+    const response = await fetch(`${instance.url}/api/tunnels/${id}`, {
+        method: "DELETE",
+        headers: {
+            Authorization: `Bearer ${session}`,
+        },
+    });
+    if (!response.ok && response.status !== 404) {
+        const errorText = await response.text();
+        throw new Error(`Failed to delete tunnel: ${response.status} ${errorText}`);
+    }
+    const tunnel = activeTunnels.find((t) => t.id === id);
+    if (tunnel) {
+        stopProxy(tunnel.port);
+    }
+    activeTunnels = activeTunnels.filter((t) => t.id !== id);
+};
+export const deleteAllTunnels = async (instance, session) => {
+    const response = await fetch(`${instance.url}/api/tunnels`, {
+        method: "DELETE",
+        headers: {
+            Authorization: `Bearer ${session}`,
+        },
+    });
+    if (!response.ok && response.status !== 404) {
+        const errorText = await response.text();
+        throw new Error(`Failed to delete all tunnels: ${response.status} ${errorText}`);
+    }
+    stopAllProxies();
+    activeTunnels = [];
+};
+export const validatePort = (port) => {
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        return "Port must be an integer between 1 and 65535";
+    }
+    return null;
+};
+export const validateName = (name) => {
+    if (name && !/^[a-z0-9-]+$/.test(name)) {
+        return "Name must only contain lowercase letters, numbers, and hyphens";
+    }
+    return null;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "onedeploy-cli",
-	"version": "0.1.10",
+	"version": "0.1.11",
 	"description": "CLI tool for connecting to OneDeploy via Nebula",
 	"keywords": [
 		"onedeploy",
@@ -32,9 +32,10 @@
 		"fix": "biome check src/* --fix"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.3.10",
-		"@types/node": "^25.0.3",
+		"@biomejs/biome": "^2.3.13",
+		"@types/node": "^25.2.0",
 		"@types/prompts": "^2.4.9",
+		"@typescript/native-preview": "^7.0.0-dev.20260203.1",
 		"typescript": "^5.9.3"
 	},
 	"dependencies": {

package/src/index.ts

@@ -1,12 +1,49 @@
 #!/usr/bin/env node
+import type { ChildProcess } from "node:child_process";
 import prompts from "prompts";
+import type { Instance } from "./config.js";
 import { loadConfig, saveConfig } from "./config.js";
 import {
 	cleanupNebula,
-	connectNebula,
+	getSession,
 	installNebula,
 	isNebulaRunning,
+	startNebula,
+	stopNebula,
 } from "./nebula.js";
+import { deleteAllTunnels } from "./tunnel.js";
+import { tunnelMenu } from "./tunnel-menu.js";
+
+// Track active connection for cleanup on signals
+let activeConnection: {
+	instance: Instance;
+	session: string;
+	nebulaProcess: ChildProcess;
+	stopRefresh: () => void;
+} | null = null;
+
+const cleanup = async () => {
+	if (activeConnection) {
+		console.log("\nCleaning up...");
+		try {
+			await deleteAllTunnels(activeConnection.instance, activeConnection.session);
+		} catch {
+			// ignore if already disconnected
+		}
+		activeConnection.stopRefresh();
+		stopNebula(activeConnection.nebulaProcess);
+		activeConnection = null;
+	}
+	await cleanupNebula();
+};
+
+const handleSignal = () => {
+	if (!isNebulaRunning) {
+		process.exit();
+	}
+	// Perform cleanup and exit
+	cleanup().finally(() => process.exit());
+};
 
 if (process.argv.includes("--version")) {
 	console.log("onedeploy-cli version 0.1.4");
@@ -127,9 +164,33 @@ const mainMenu = async (): Promise<boolean> => {
 		urlToConnect = selection;
 	}
 
-	// Connect first
 	const instance = { url: urlToConnect, apiKey: "" };
-	await connectNebula(instance);
+
+	// 1. Authenticate
+	const session = await getSession(instance);
+
+	// 2. Start Nebula (non-blocking)
+	const { nebulaProcess, stopRefresh } = await startNebula(instance, session);
+
+	// Track connection for signal handlers
+	activeConnection = { instance, session, nebulaProcess, stopRefresh };
+
+	// 3. Enter tunnel management loop
+	try {
+		await tunnelMenu(instance, session);
+	} finally {
+		// 4. Cleanup on exit
+		console.log("Cleaning up tunnels...");
+		try {
+			await deleteAllTunnels(instance, session);
+		} catch {
+			// ignore if already disconnected
+		}
+
+		stopRefresh();
+		stopNebula(nebulaProcess);
+		activeConnection = null;
+	}
 
 	// Only save if connection was successful (didn't throw)
 	await addInstance(urlToConnect);
@@ -141,8 +202,12 @@ process.on("SIGINT", () => {
 	if (!isNebulaRunning) {
 		process.exit();
 	}
-	// ignore SIGINTs to continue after Nebula is disconnected
+	// When Nebula is running, let prompts handle SIGINT (returns undefined)
+	// which triggers the finally block in mainMenu
 });
+process.on("SIGTERM", handleSignal);
+process.on("SIGHUP", handleSignal);
+
 await installNebula();
 try {
 	while (true) {
@@ -152,5 +217,5 @@ try {
 		}
 	}
 } finally {
-	await cleanupNebula();
+	await cleanup();
 }