propr-cli 0.8.5 → 0.8.6

package/README.md

@@ -60,6 +60,42 @@ and exits nonzero when required local stack prerequisites are missing. Scripts
 or shell integrations that invoked bare `propr` to print help text should call
 `propr --help` instead.
 
+## Hosted UI Tunnel
+
+ProPR Connect can provision a managed Cloudflare Tunnel so the hosted UI at
+`https://app.propr.dev` can reach your local stack's API. Run the one-time setup
+command shown in ProPR Connect from your initialized stack directory:
+
+```bash
+npm install -g propr-cli@latest
+propr tunnel setup --token <connector-token> --url https://t-<id>.propr.dev --start
+```
+
+Connect-managed tunnels require `propr-cli` 0.8.6 or newer. The setup command
+writes the tunnel token, instance id, hosted UI origin, public API URL, and
+OAuth callback URL to the stack `.env`, records tunnel mode as enabled, and with
+`--start` starts or recreates the stack so the API picks up the hosted URLs
+immediately. If you have only the instance id, `--instance-id <id>` derives the
+same public URL.
+
+The public tunnel origin is always a bare `https://t-<id>.propr.dev` URL; ProPR
+routes only `/api/*` and `/socket.io/*` through it, and the root URL
+intentionally returns 404. The hosted UI itself stays on `https://app.propr.dev`
+and calls the API through the per-instance tunnel host.
+
+Useful follow-up commands:
+
+```bash
+propr tunnel verify      # check cloudflared + /api/status, /, /socket.io/
+propr tunnel off         # stop only the sidecar; token/env values stay in .env
+propr tunnel on          # restart the sidecar later
+```
+
+`propr tunnel off` intentionally leaves the Connect-written `.env` values in
+place. If you are switching the same stack back to a local or custom self-hosted
+UI, remove or replace `PROPR_UI_PUBLIC_API_URL`, `API_PUBLIC_URL`,
+`FRONTEND_URL`, and `GH_OAUTH_CALLBACK_URL` before restarting.
+
 ## Repository Setup
 
 Use `propr init` from a repository root to scaffold `.propr` setup files used by agent execution containers.

package/dist/commands/tunnelCommand.js

@@ -17,7 +17,7 @@
  */
 import { Command } from "commander";
 import { join } from "node:path";
-import { DEFAULT_PROPR_UI_ORIGIN, proprTunnelEndpoints, isProprProxyUrl, PROPR_UI_PROXY_SUFFIX, } from "../vendor/shared/index.js";
+import { DEFAULT_PROPR_UI_ORIGIN, proprInstanceProxyUrl, proprTunnelEndpoints, isProprProxyUrl, PROPR_UI_PROXY_SUFFIX, PROPR_UI_PROXY_LABEL_PREFIX, } from "../vendor/shared/index.js";
 import { createConfigManager } from "../config/index.js";
 import { getHostConfig, resolveStackRoot } from "../orchestrator/index.js";
 import { parseOnOffState, ParseStateError } from "../utils/index.js";
@@ -34,7 +34,7 @@ export class TunnelTokenMissingError extends Error {
 /**
  * Thrown by applyTunnelToggle when `tunnel on` is requested but no public proxy
  * URL can be derived. Hosted UI tunnel mode fundamentally needs an advertised
- * endpoint (`PROPR_INSTANCE_ID` → https://<id>.proxy.propr.dev, or an explicit
+ * endpoint (`PROPR_INSTANCE_ID` → https://t-<id>.propr.dev, or an explicit
  * `PROPR_UI_PUBLIC_API_URL`); without one the sidecar would start and the desired
  * state persist while the hosted UI has no usable endpoint, surfacing only as
  * later status/verify failures. So we refuse up front instead.
@@ -42,7 +42,7 @@ export class TunnelTokenMissingError extends Error {
 export class TunnelPublicUrlMissingError extends Error {
     constructor() {
         super("cannot start the tunnel — no public proxy URL can be derived.\n" +
-            "  The hosted UI reaches this stack at https://<id>.proxy.propr.dev, so set\n" +
+            "  The hosted UI reaches this stack at https://t-<id>.propr.dev, so set\n" +
             "  PROPR_INSTANCE_ID (preferred) or an explicit PROPR_UI_PUBLIC_API_URL in\n" +
             "  your stack .env, then run 'propr tunnel on' again.");
         this.name = "TunnelPublicUrlMissingError";
@@ -50,7 +50,7 @@ export class TunnelPublicUrlMissingError extends Error {
 }
 /**
  * Thrown by applyTunnelToggle when `tunnel on` is requested with a public proxy
- * URL that is not a hosted `https://<id>.proxy.propr.dev` URL. propr-routing only
+ * URL that is not a hosted `https://t-<id>.propr.dev` URL. propr-routing only
  * forwards `/api/*` and `/socket.io/*` on those hosts, so an explicit
  * `PROPR_UI_PUBLIC_API_URL` pointing anywhere else (e.g. https://custom.example.com)
  * would start a sidecar the hosted UI cannot route to. The launcher's
@@ -61,10 +61,10 @@ export class TunnelPublicUrlMissingError extends Error {
 export class TunnelPublicUrlInvalidError extends Error {
     constructor(url) {
         super(`cannot start the tunnel — PROPR_UI_PUBLIC_API_URL ("${url}") is not a\n` +
-            `  hosted proxy URL (https://<id>.${PROPR_UI_PROXY_SUFFIX}). The tunnel only\n` +
+            `  hosted proxy URL (https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX}). The tunnel only\n` +
             `  routes /api/* and /socket.io/* on ${PROPR_UI_PROXY_SUFFIX} hosts, so the\n` +
             "  hosted UI could not reach this stack. Set PROPR_INSTANCE_ID (preferred) or\n" +
-            `  a https://<id>.${PROPR_UI_PROXY_SUFFIX} URL, then run 'propr tunnel on' again.`);
+            `  a https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX} URL, then run 'propr tunnel on' again.`);
         this.name = "TunnelPublicUrlInvalidError";
     }
 }
@@ -165,7 +165,7 @@ export async function applyTunnelToggle({ enable, cfg, orch, configManager, forc
     }
     // A derived public URL is always a well-formed proxy URL, but an explicit
     // PROPR_UI_PUBLIC_API_URL can be anything. propr-routing only forwards /api/*
-    // and /socket.io/* on https://<id>.proxy.propr.dev hosts, so a non-proxy URL
+    // and /socket.io/* on https://t-<id>.propr.dev hosts, so a non-proxy URL
     // would start a sidecar the hosted UI cannot route to. validateEnv() rejects
     // this for `propr start`/`propr check`; mirror it here so `propr tunnel on`
     // doesn't persist/start an unroutable configuration those commands would refuse.
@@ -283,8 +283,12 @@ function instanceIdFromProxyUrl(url) {
         return undefined;
     }
     const suffix = `.${PROPR_UI_PROXY_SUFFIX}`;
-    return parsed.protocol === "https:" && parsed.hostname.endsWith(suffix)
-        ? parsed.hostname.slice(0, -suffix.length)
+    if (parsed.protocol !== "https:" || !parsed.hostname.endsWith(suffix)) {
+        return undefined;
+    }
+    const label = parsed.hostname.slice(0, -suffix.length);
+    return label.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)
+        ? label.slice(PROPR_UI_PROXY_LABEL_PREFIX.length)
         : undefined;
 }
 export function buildTunnelSetupEnv(input) {
@@ -294,11 +298,14 @@ export function buildTunnelSetupEnv(input) {
     const explicitUrl = input.url?.trim().replace(/\/+$/, "");
     const explicitInstanceId = input.instanceId?.trim();
     if (!explicitUrl && !explicitInstanceId) {
-        throw new Error("provide --url https://<id>.proxy.propr.dev or --instance-id <id>");
+        throw new Error("provide --url https://t-<id>.propr.dev or --instance-id <id>");
+    }
+    const candidateUrl = explicitUrl ?? proprInstanceProxyUrl(explicitInstanceId);
+    if (!candidateUrl) {
+        throw new Error(`could not derive a hosted proxy URL from --instance-id (${explicitInstanceId})`);
     }
-    const candidateUrl = explicitUrl ?? `https://${explicitInstanceId}.${PROPR_UI_PROXY_SUFFIX}`;
     if (!isProprProxyUrl(candidateUrl)) {
-        throw new Error(`tunnel URL must be a bare hosted proxy URL such as https://<id>.${PROPR_UI_PROXY_SUFFIX} (no path/query/fragment)`);
+        throw new Error(`tunnel URL must be a bare hosted proxy URL such as https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX} (no path/query/fragment)`);
     }
     // Canonicalize: URL parsing already lowercases the host, and `.origin` drops
     // any (validated-absent) path so the persisted value matches what the launcher
@@ -306,11 +313,16 @@ export function buildTunnelSetupEnv(input) {
     // mixed-case --instance-id would otherwise diverge from the launcher's value.
     const publicUrl = new URL(candidateUrl).origin;
     const derivedInstanceId = instanceIdFromProxyUrl(publicUrl);
-    const instanceId = (explicitInstanceId ?? derivedInstanceId)?.toLowerCase();
+    const normalizedExplicitInstanceId = explicitInstanceId?.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)
+        ? explicitInstanceId.slice(PROPR_UI_PROXY_LABEL_PREFIX.length)
+        : explicitInstanceId;
+    const instanceId = (normalizedExplicitInstanceId ?? derivedInstanceId)?.toLowerCase();
     if (!instanceId) {
         throw new Error(`could not derive an instance id from ${publicUrl}`);
     }
-    if (derivedInstanceId && explicitInstanceId && derivedInstanceId.toLowerCase() !== explicitInstanceId.toLowerCase()) {
+    if (derivedInstanceId &&
+        normalizedExplicitInstanceId &&
+        derivedInstanceId.toLowerCase() !== normalizedExplicitInstanceId.toLowerCase()) {
         throw new Error(`--instance-id (${explicitInstanceId}) does not match --url host (${derivedInstanceId})`);
     }
     return {
@@ -505,20 +517,20 @@ export function createTunnelCommand() {
         .option("--root <dir>", "Stack root directory")
         .option("--force", "With 'on', start the tunnel even if the core stack is not running")
         .option("--token <token>", "Connector token from ProPR Connect (setup only)")
-        .option("--url <url>", "Public proxy URL from ProPR Connect, e.g. https://<id>.proxy.propr.dev (setup only)")
-        .option("--instance-id <id>", "Instance id from ProPR Connect; derives https://<id>.proxy.propr.dev (setup only)")
+        .option("--url <url>", "Public proxy URL from ProPR Connect, e.g. https://t-<id>.propr.dev (setup only)")
+        .option("--instance-id <id>", "Instance id from ProPR Connect; derives https://t-<id>.propr.dev (setup only)")
         .option("--start", "After setup, start or restart the stack with hosted tunnel settings")
         .addHelpText("after", `
 Setup writes the tunnel settings to your stack .env for you:
 
-  $ propr tunnel setup --token <connector-token> --url https://<id>.proxy.propr.dev --start
+  $ propr tunnel setup --token <connector-token> --url https://t-<id>.propr.dev --start
 
 Starting the tunnel requires a token AND a public proxy URL:
   PROPR_UI_TUNNEL_TOKEN    Cloudflare Tunnel token (required to start). This is a
                            live Cloudflare credential — do not commit, log, or share it
   PROPR_UI_TUNNEL_ENABLED  Explicitly enables the managed tunnel sidecar
   PROPR_INSTANCE_ID        Instance id; derives the public URL
-                           https://<id>.proxy.propr.dev (required unless
+                           https://t-<id>.propr.dev (required unless
                            PROPR_UI_PUBLIC_API_URL is set)
   PROPR_UI_PUBLIC_API_URL  Explicit public API URL advertised through the tunnel
                            (overrides the id-derived URL)

package/dist/orchestrator/manifest.json

@@ -1,16 +1,16 @@
 {
-  "version": "0.8.5",
-  "git_sha": "45e9ed5a",
+  "version": "0.8.6",
+  "git_sha": "cdf74ac2",
   "registry": "propr",
   "images": {
-    "app": "propr/app:0.8.5",
-    "ui": "propr/ui:0.8.5",
-    "docs": "propr/docs:0.8.5",
-    "agent-claude": "propr/agent-claude:0.8.5",
-    "agent-codex": "propr/agent-codex:0.8.5",
-    "agent-antigravity": "propr/agent-antigravity:0.8.5",
-    "agent-opencode": "propr/agent-opencode:0.8.5",
-    "agent-vibe": "propr/agent-vibe:0.8.5",
+    "app": "propr/app:0.8.6",
+    "ui": "propr/ui:0.8.6",
+    "docs": "propr/docs:0.8.6",
+    "agent-claude": "propr/agent-claude:0.8.6",
+    "agent-codex": "propr/agent-codex:0.8.6",
+    "agent-antigravity": "propr/agent-antigravity:0.8.6",
+    "agent-opencode": "propr/agent-opencode:0.8.6",
+    "agent-vibe": "propr/agent-vibe:0.8.6",
     "redis": "redis:7-alpine",
     "cloudflared": "cloudflare/cloudflared:2024.12.2"
   }

package/dist/orchestrator/orchestrator.mjs

@@ -26,11 +26,13 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 // Hosted UI tunnel naming. These mirror the shared TypeScript constants in
 // packages/shared/src/proprServiceUrls.ts (PROPR_UI_PROXY_SUFFIX,
-// DEFAULT_CLOUDFLARED_IMAGE, DEFAULT_PROPR_UI_ORIGIN) — kept as plain literals
-// here because this module is dependency-free .mjs (Node stdlib only) and cannot
-// import the TS package. Change one, change the other;
+// PROPR_UI_PROXY_LABEL_PREFIX, DEFAULT_CLOUDFLARED_IMAGE,
+// DEFAULT_PROPR_UI_ORIGIN) — kept as plain literals here because this module is
+// dependency-free .mjs (Node stdlib only) and cannot import the TS package.
+// Change one, change the other;
 // test/orchestratorProprUrlsDrift.test.ts guards against the copies diverging.
-export const PROPR_UI_PROXY_SUFFIX = 'proxy.propr.dev';
+export const PROPR_UI_PROXY_SUFFIX = 'propr.dev';
+export const PROPR_UI_PROXY_LABEL_PREFIX = 't-';
 // Fallback used only when the manifest has no `cloudflared` entry. Pin it to the
 // same tag the manifest ships (docker/launcher/manifest.json) so the effective
 // default is identical whether it comes from the manifest or this fallback —
@@ -39,28 +41,29 @@ export const DEFAULT_CLOUDFLARED_IMAGE = 'cloudflare/cloudflared:2024.12.2';
 export const DEFAULT_PROPR_UI_ORIGIN = 'https://app.propr.dev';
 
 // Whether an instance id is a valid single DNS label for the proxy hostname
-// (<id>.proxy.propr.dev): 1–63 chars, ASCII letters/digits/hyphens only, no
+// (t-<id>.propr.dev): 1–63 chars, ASCII letters/digits/hyphens only, no
 // leading/trailing hyphen. Mirrors isValidProprInstanceId() in the shared pkg.
 export function isValidProprInstanceId(instanceId) {
     const id = (instanceId ?? '').trim();
     return /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i.test(id);
 }
 
-// Derive the per-instance public API/UI URL (https://<instanceId>.proxy.propr.dev)
+// Derive the per-instance public API/UI URL (https://t-<instanceId>.propr.dev)
 // from an instance id; returns undefined for a missing/blank or invalid id (so a
-// malformed hostname is never emitted). The id is lowercased so a mixed-case
-// PROPR_INSTANCE_ID yields a canonical hostname (DNS is case-insensitive).
+// malformed hostname is never emitted). Accepts either the bare id or the public
+// t-<id> DNS label. The id is lowercased so a mixed-case PROPR_INSTANCE_ID
+// yields a canonical hostname (DNS is case-insensitive).
 // Mirrors proprInstanceProxyUrl() in packages/shared/src/proprServiceUrls.ts.
 export function proprInstanceProxyUrl(instanceId) {
-    const id = (instanceId ?? '').trim();
-    return isValidProprInstanceId(id) ? `https://${id.toLowerCase()}.${PROPR_UI_PROXY_SUFFIX}` : undefined;
+    const id = normalizeProprInstanceId(instanceId);
+    return isValidProprInstanceId(id) ? `https://${PROPR_UI_PROXY_LABEL_PREFIX}${id.toLowerCase()}.${PROPR_UI_PROXY_SUFFIX}` : undefined;
 }
 
-// Whether a URL is a hosted per-instance proxy URL (https://<id>.proxy.propr.dev).
+// Whether a URL is a hosted per-instance proxy URL (https://t-<id>.propr.dev).
 // propr-routing only forwards /api/* and /socket.io/* on these hosts, so the
-// tunnel base URL must be one of them. Requires exactly one valid instance-id
-// label before the suffix (a nested host like foo.bar.proxy.propr.dev is
-// rejected) and a bare origin (a non-root path/query/fragment is rejected so
+// tunnel base URL must be one of them. Requires exactly one t-<instance-id>
+// label before the suffix (other propr.dev hosts and nested hosts are rejected)
+// and a bare origin (a non-root path/query/fragment is rejected so
 // proprTunnelEndpoints does not double up the /api prefix). Mirrors
 // isProprProxyUrl() in the shared pkg.
 export function isProprProxyUrl(url) {
@@ -73,12 +76,23 @@ export function isProprProxyUrl(url) {
         if (/[^/]/.test(pathname) || search || hash) return false;
         const suffix = `.${PROPR_UI_PROXY_SUFFIX}`;
         if (!hostname.endsWith(suffix)) return false;
-        return isValidProprInstanceId(hostname.slice(0, -suffix.length));
+        const label = hostname.slice(0, -suffix.length);
+        if (label.includes('.') || !label.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)) {
+            return false;
+        }
+        return isValidProprInstanceId(label.slice(PROPR_UI_PROXY_LABEL_PREFIX.length));
     } catch {
         return false;
     }
 }
 
+function normalizeProprInstanceId(instanceId) {
+    const id = (instanceId ?? '').trim();
+    return id.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)
+        ? id.slice(PROPR_UI_PROXY_LABEL_PREFIX.length)
+        : id;
+}
+
 // The concrete endpoints the hosted UI reaches through the tunnel base URL.
 // propr-routing only allows /api/* and /socket.io/*, so the base (root) URL
 // itself intentionally returns 404 — it is NOT a health target; probe apiStatus
@@ -1458,7 +1472,7 @@ export function validateEnv(cfg) {
     if (cfg.uiTunnelEnabled && !cfg.uiPublicApiUrl) {
         errors.push(
             cfg.proprInstanceId
-                ? `PROPR_INSTANCE_ID ("${cfg.proprInstanceId}") is not a valid DNS label, so no https://<id>.proxy.propr.dev URL can be derived. The tunnel would start while the API advertises its localhost URL and the frontend points at the hosted UI, leaving the hosted UI with no endpoint to reach. Set a valid instance id (1–63 letters/digits/hyphens, no leading/trailing hyphen) or an explicit PROPR_UI_PUBLIC_API_URL.`
+                ? `PROPR_INSTANCE_ID ("${cfg.proprInstanceId}") is not a valid DNS label, so no https://t-<id>.propr.dev URL can be derived. The tunnel would start while the API advertises its localhost URL and the frontend points at the hosted UI, leaving the hosted UI with no endpoint to reach. Set a valid instance id (1–63 letters/digits/hyphens, no leading/trailing hyphen) or an explicit PROPR_UI_PUBLIC_API_URL.`
                 : 'The UI tunnel is enabled but neither PROPR_INSTANCE_ID nor PROPR_UI_PUBLIC_API_URL is set, so no public proxy URL can be derived. The tunnel would start while the API advertises its localhost URL, leaving the hosted UI with no endpoint to reach. Set PROPR_INSTANCE_ID (preferred) or an explicit PROPR_UI_PUBLIC_API_URL.'
         );
     }
@@ -1477,7 +1491,7 @@ export function validateEnv(cfg) {
     // tunnel is ENABLED the value is advertised to the API/worker, probed by
     // getTunnelStatus()/verify, and must point at a hosted proxy host because
     // propr-routing only forwards /api/* and /socket.io/* on
-    // https://<id>.proxy.propr.dev — so a non-proxy URL would start an unroutable
+    // https://t-<id>.propr.dev — so a non-proxy URL would start an unroutable
     // tunnel stack (matching the routing rule and the `propr tunnel on` guard). With
     // the tunnel off, any valid http(s) origin the UI should call is legitimate, so
     // only the well-formedness check applies.
@@ -1485,9 +1499,9 @@ export function validateEnv(cfg) {
         let parsed;
         try { parsed = new URL(cfg.uiPublicApiUrl); } catch { /* invalid below */ }
         if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {
-            errors.push(`PROPR_UI_PUBLIC_API_URL ("${cfg.uiPublicApiUrl}") is not a valid http(s) URL. It is injected into the UI container (config.js) as the browser's API base URL even when the tunnel is off, so a malformed value breaks the UI. Use a full URL such as https://abc123.proxy.propr.dev.`);
+            errors.push(`PROPR_UI_PUBLIC_API_URL ("${cfg.uiPublicApiUrl}") is not a valid http(s) URL. It is injected into the UI container (config.js) as the browser's API base URL even when the tunnel is off, so a malformed value breaks the UI. Use a full URL such as https://t-abc123.propr.dev.`);
         } else if (cfg.uiTunnelEnabled && !isProprProxyUrl(cfg.uiPublicApiUrl)) {
-            errors.push(`PROPR_UI_PUBLIC_API_URL ("${cfg.uiPublicApiUrl}") is not a hosted proxy URL (https://<id>.${PROPR_UI_PROXY_SUFFIX}). The tunnel only routes /api/* and /socket.io/* on ${PROPR_UI_PROXY_SUFFIX} hosts, so the hosted UI would be unable to reach this stack. Set PROPR_INSTANCE_ID or a bare https://<id>.${PROPR_UI_PROXY_SUFFIX} origin (no path/query/fragment — the /api and /socket.io paths are appended automatically).`);
+            errors.push(`PROPR_UI_PUBLIC_API_URL ("${cfg.uiPublicApiUrl}") is not a hosted proxy URL (https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX}). The tunnel only routes /api/* and /socket.io/* on ${PROPR_UI_PROXY_SUFFIX} hosts, so the hosted UI would be unable to reach this stack. Set PROPR_INSTANCE_ID or a bare https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX} origin (no path/query/fragment — the /api and /socket.io paths are appended automatically).`);
         }
     }
 
@@ -1498,7 +1512,7 @@ export function validateEnv(cfg) {
     // hosted app.propr.dev CORS, cookies, and public links even though the
     // cloudflared sidecar itself starts successfully.
     if (cfg.uiTunnelEnabled && isLocalhostHttpUrl(cfg.apiPublicUrl)) {
-        errors.push(`API_PUBLIC_URL ("${cfg.apiPublicUrl}") still points at localhost while the UI tunnel is enabled. In tunnel mode the API must advertise the hosted proxy URL (for example https://<id>.${PROPR_UI_PROXY_SUFFIX}) so app.propr.dev can reach this stack. Remove the explicit API_PUBLIC_URL or set it to the hosted proxy URL.`);
+        errors.push(`API_PUBLIC_URL ("${cfg.apiPublicUrl}") still points at localhost while the UI tunnel is enabled. In tunnel mode the API must advertise the hosted proxy URL (for example https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX}) so app.propr.dev can reach this stack. Remove the explicit API_PUBLIC_URL or set it to the hosted proxy URL.`);
     }
     if (cfg.uiTunnelEnabled && isLocalhostHttpUrl(cfg.frontendUrl)) {
         errors.push(`FRONTEND_URL ("${cfg.frontendUrl}") still points at localhost while the UI tunnel is enabled. In tunnel mode FRONTEND_URL must be ${DEFAULT_PROPR_UI_ORIGIN} so CORS and redirects allow the hosted UI. Remove the explicit FRONTEND_URL or set it to ${DEFAULT_PROPR_UI_ORIGIN}.`);
@@ -1510,7 +1524,7 @@ export function validateEnv(cfg) {
     // hosted UI cannot reach. Warn so the operator updates it (and the GitHub App
     // config) to the public proxy callback.
     if (cfg.uiTunnelEnabled && /^https?:\/\/(localhost|127\.0\.0\.1)\b/i.test(cfg.ghOauthCallbackUrl)) {
-        warnings.push(`GH_OAUTH_CALLBACK_URL ("${cfg.ghOauthCallbackUrl}") still points at localhost while the UI tunnel is enabled. GitHub OAuth will redirect the browser to a localhost URL the hosted UI cannot reach. Set GH_OAUTH_CALLBACK_URL to your public proxy callback (e.g. https://<id>.${PROPR_UI_PROXY_SUFFIX}/api/auth/github/callback) and register it in the GitHub App.`);
+        warnings.push(`GH_OAUTH_CALLBACK_URL ("${cfg.ghOauthCallbackUrl}") still points at localhost while the UI tunnel is enabled. GitHub OAuth will redirect the browser to a localhost URL the hosted UI cannot reach. Set GH_OAUTH_CALLBACK_URL to your public proxy callback (e.g. https://${PROPR_UI_PROXY_LABEL_PREFIX}<id>.${PROPR_UI_PROXY_SUFFIX}/api/auth/github/callback) and register it in the GitHub App.`);
     }
 
     const hasOpenCodeConfig = Boolean(cfg.hostOpencodeXdgDir);

package/dist/vendor/shared/index.js

@@ -10,7 +10,7 @@ export { validateRelayUrl } from './validateRelayUrl.js';
 // Export the hosted propr-routing service default URLs (one source of truth for
 // the webhook.propr.dev host shared by the CLI, the daemon dialer, and the
 // boot/check prerequisite validators)
-export { DEFAULT_PROPR_ROUTING_URL, DEFAULT_PROPR_GH_RELAY_URL, DEFAULT_PROPR_UI_ORIGIN, PROPR_UI_PROXY_SUFFIX, DEFAULT_CLOUDFLARED_IMAGE, proprInstanceProxyUrl, isValidProprInstanceId, isProprProxyUrl, proprTunnelEndpoints, } from './proprServiceUrls.js';
+export { DEFAULT_PROPR_ROUTING_URL, DEFAULT_PROPR_GH_RELAY_URL, DEFAULT_PROPR_UI_ORIGIN, PROPR_UI_PROXY_SUFFIX, PROPR_UI_PROXY_LABEL_PREFIX, DEFAULT_CLOUDFLARED_IMAGE, proprInstanceProxyUrl, isValidProprInstanceId, isProprProxyUrl, proprTunnelEndpoints, } from './proprServiceUrls.js';
 // Export routing URL validation (shared by intake prerequisites and the daemon
 // routing service so the boot/CLI checks and the dialer agree on one policy)
 export { validateRoutingUrl } from './validateRoutingUrl.js';

package/dist/vendor/shared/proprCompatibility.js

@@ -5,7 +5,7 @@
 // updates packages/shared/package.json or docker/launcher/manifest.json but
 // forgets this constant is caught by the drift test in
 // test/orchestratorProprUrlsDrift.test.ts, which asserts all three agree.
-export const PROPR_VERSION = '0.8.5';
+export const PROPR_VERSION = '0.8.6';
 // Bump this only when the API/UI contract changes in a way the hosted UI must
 // account for. Patch releases that do not change the browser-facing contract can
 // keep the same compatibility version.

package/dist/vendor/shared/proprServiceUrls.js

@@ -27,15 +27,18 @@ export const DEFAULT_PROPR_GH_RELAY_URL = 'https://webhook.propr.dev/v1';
 /**
  * Origin of the hosted Propr UI (https://app.propr.dev). This is where the
  * managed control plane is served from; a local stack exposes its own UI on a
- * tunnel under {@link PROPR_UI_PROXY_SUFFIX} so the hosted UI can reach it.
+ * tunnel under a {@link PROPR_UI_PROXY_LABEL_PREFIX} host on
+ * {@link PROPR_UI_PROXY_SUFFIX} so the hosted UI can reach it.
  */
 export const DEFAULT_PROPR_UI_ORIGIN = 'https://app.propr.dev';
 /**
- * DNS suffix for per-instance UI/API tunnel hostnames. Each local stack with an
- * instance id is reachable at `https://<instanceId>.proxy.propr.dev`, so the
- * hosted UI at {@link DEFAULT_PROPR_UI_ORIGIN} can discover and address it.
+ * DNS suffix and label prefix for per-instance UI/API tunnel hostnames. Each
+ * local stack with an instance id is reachable at
+ * `https://t-<instanceId>.propr.dev`, so the hosted UI at
+ * {@link DEFAULT_PROPR_UI_ORIGIN} can discover and address it.
  */
-export const PROPR_UI_PROXY_SUFFIX = 'proxy.propr.dev';
+export const PROPR_UI_PROXY_SUFFIX = 'propr.dev';
+export const PROPR_UI_PROXY_LABEL_PREFIX = 't-';
 /**
  * Default Cloudflare Tunnel image used to expose the local stack's UI/API to
  * the hosted control plane when a UI tunnel is enabled. This is only a fallback:
@@ -46,7 +49,7 @@ export const PROPR_UI_PROXY_SUFFIX = 'proxy.propr.dev';
 export const DEFAULT_CLOUDFLARED_IMAGE = 'cloudflare/cloudflared:2024.12.2';
 /**
  * Whether an instance id is usable as a single DNS label in the per-instance
- * proxy hostname (`<id>.proxy.propr.dev`). Enforces the standard label rules:
+ * proxy hostname (`t-<id>.propr.dev`). Enforces the standard label rules:
  * 1–63 characters, ASCII letters/digits/hyphens only, and no leading or
  * trailing hyphen. This rejects spaces, slashes, dots, underscores, and other
  * characters that would produce an invalid or ambiguous hostname.
@@ -57,30 +60,31 @@ export function isValidProprInstanceId(instanceId) {
 }
 /**
  * Derive the public API/UI URL for a local stack from its instance id, using
- * the shared {@link PROPR_UI_PROXY_SUFFIX}. Returns `https://abc123.proxy.propr.dev`
- * for instance id `abc123`. Returns `undefined` for a missing/blank id — or an
- * id that is not a valid DNS label (see {@link isValidProprInstanceId}) — so
- * callers can fall back to an explicit URL or a local-development default
- * rather than emitting a malformed hostname. The id is lowercased so a
- * mixed-case instance id yields a canonical hostname (DNS is case-insensitive).
+ * the shared public tunnel host pattern. Returns `https://t-abc123.propr.dev`
+ * for instance id `abc123`. A caller may pass either the bare instance id or the
+ * public DNS label (`t-abc123`); the returned URL is canonicalized. Returns
+ * `undefined` for a missing/blank id — or an id that is not a valid DNS label
+ * (see {@link isValidProprInstanceId}) — so callers can fall back to an explicit
+ * URL or a local-development default rather than emitting a malformed hostname.
+ * The id is lowercased so a mixed-case instance id yields a canonical hostname
+ * (DNS is case-insensitive).
  */
 export function proprInstanceProxyUrl(instanceId) {
-    const id = (instanceId ?? '').trim();
+    const id = normalizeProprInstanceId(instanceId);
     if (!isValidProprInstanceId(id))
         return undefined;
-    return `https://${id.toLowerCase()}.${PROPR_UI_PROXY_SUFFIX}`;
+    return `https://${PROPR_UI_PROXY_LABEL_PREFIX}${id.toLowerCase()}.${PROPR_UI_PROXY_SUFFIX}`;
 }
 /**
- * Whether a URL is a hosted per-instance proxy URL (`https://<id>.proxy.propr.dev`).
+ * Whether a URL is a hosted per-instance proxy URL (`https://t-<id>.propr.dev`).
  * propr-routing only forwards `/api/*` and `/socket.io/*` on these hosts, so the
  * tunnel base URL must be one of them. Requires https and *exactly one* valid
- * instance-id label in front of the shared {@link PROPR_UI_PROXY_SUFFIX} — a
- * multi-label host like `foo.bar.proxy.propr.dev` is rejected because routing
- * only addresses a single instance label. It must also be a bare origin: a
- * non-root path, query, or fragment (e.g. `https://abc.proxy.propr.dev/api`) is
- * rejected because {@link proprTunnelEndpoints} appends `/api/...` itself and a
- * base path would double it up (`.../api/api/status`). Returns false for a
- * malformed URL.
+ * `t-<instance-id>` label in front of the shared {@link PROPR_UI_PROXY_SUFFIX}.
+ * Other propr.dev hosts like `app.propr.dev` and nested hosts are rejected. It
+ * must also be a bare origin: a non-root path, query, or fragment (e.g.
+ * `https://t-abc.propr.dev/api`) is rejected because
+ * {@link proprTunnelEndpoints} appends `/api/...` itself and a base path would
+ * double it up (`.../api/api/status`). Returns false for a malformed URL.
  */
 export function isProprProxyUrl(url) {
     if (!url)
@@ -98,14 +102,22 @@ export function isProprProxyUrl(url) {
         const suffix = `.${PROPR_UI_PROXY_SUFFIX}`;
         if (!hostname.endsWith(suffix))
             return false;
-        // The portion before the suffix must be a single valid DNS label (no dots),
-        // so isValidProprInstanceId rejects nested hosts like `a.b.proxy.propr.dev`.
-        return isValidProprInstanceId(hostname.slice(0, -suffix.length));
+        const label = hostname.slice(0, -suffix.length);
+        if (label.includes('.') || !label.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)) {
+            return false;
+        }
+        return isValidProprInstanceId(label.slice(PROPR_UI_PROXY_LABEL_PREFIX.length));
     }
     catch {
         return false;
     }
 }
+function normalizeProprInstanceId(instanceId) {
+    const id = (instanceId ?? '').trim();
+    return id.startsWith(PROPR_UI_PROXY_LABEL_PREFIX)
+        ? id.slice(PROPR_UI_PROXY_LABEL_PREFIX.length)
+        : id;
+}
 /**
  * The concrete endpoints the hosted UI reaches through the tunnel base URL.
  * propr-routing only allows `/api/*` and `/socket.io/*`, so the base (root) URL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propr-cli",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "CLI for interacting with the ProPR backend",
   "type": "module",
   "bin": {