rechrome 1.32.0 → 1.34.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.32.0",
+  "version": "1.34.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -377,20 +377,32 @@ export function buildListenChoices(interfaces: ReturnType<typeof networkInterfac
   return choices.sort((a, b) => rank[a.kind] - rank[b.kind]);
 }
 
+// The Mac app's binary only acts as the CLI when it is told to (or has a terminal): from a
+// daemon it tries to start the GUI and fails. Harmless for the standalone CLI.
+const TAILSCALE_ENV = { ...process.env, TAILSCALE_BE_CLI: "1" };
 const tailscaleBinary = () => Bun.which("tailscale") || (existsSync("/Applications/Tailscale.app/Contents/MacOS/Tailscale") ? "/Applications/Tailscale.app/Contents/MacOS/Tailscale" : null);
 
-/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
-async function runTailscale(args: string[]): Promise<string | null> {
+/** Run the Tailscale CLI read-only: its output, or why it gave none (missing, failed, slow). */
+async function runTailscaleDetailed(args: string[]): Promise<{ output: string } | { error: string; missing?: true }> {
   const binary = tailscaleBinary();
-  if (!binary) return null;
+  if (!binary) return { error: "not installed", missing: true };
   try {
-    const proc = Bun.spawn([binary, ...args], { stdout: "pipe", stderr: "ignore" });
-    const timeout = setTimeout(() => proc.kill(), 2000);
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "pipe" });
+    let timedOut = false;
+    const timeout = setTimeout(() => { timedOut = true; proc.kill(); }, 2000);
     try {
-      const output = await new Response(proc.stdout).text();
-      return await proc.exited === 0 ? output : null;
+      const [output, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+      if (await proc.exited === 0) return { output };
+      const reason = timedOut ? "no answer within 2s" : (stderr.trim() || output.trim()).split("\n")[0] || `exit ${proc.exitCode}`;
+      return { error: `\`tailscale ${args.join(" ")}\`: ${reason}` };
     } finally { clearTimeout(timeout); }
-  } catch { return null; }
+  } catch (error) { return { error: String(error) }; }
+}
+
+/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
+async function runTailscale(args: string[]): Promise<string | null> {
+  const result = await runTailscaleDetailed(args);
+  return "output" in result ? result.output : null;
 }
 
 export async function detectListenChoices(): Promise<ListenChoice[]> {
@@ -445,6 +457,140 @@ export async function detectTailscaleServe(port: number, prefix: string): Promis
   return { dnsName, routeUrl, ...serveMountsAndFunnel(serveStatus, routeUrl ? new URL(routeUrl).hostname : dnsName) };
 }
 
+type ServeHandler = { hostPort: string; mount: string; target: URL };
+
+/** Every Serve route that proxies to a loopback HTTP port. */
+function loopbackServeHandlers(serveStatus: unknown): ServeHandler[] {
+  const web = (serveStatus as { Web?: Record<string, { Handlers?: Record<string, { Proxy?: string }> }> } | null)?.Web ?? {};
+  const handlers: ServeHandler[] = [];
+  for (const [hostPort, config] of Object.entries(web)) {
+    for (const [path, handler] of Object.entries(config.Handlers ?? {})) {
+      if (!handler.Proxy) continue;
+      let target: URL;
+      try { target = new URL(/^[a-z]+:\/\//i.test(handler.Proxy) ? handler.Proxy : `http://${handler.Proxy}`); } catch { continue; }
+      if (!["127.0.0.1", "localhost", "[::1]"].includes(target.hostname) || !target.port) continue;
+      handlers.push({ hostPort, mount: path.replace(/\/+$/, "") || "/", target });
+    }
+  }
+  return handlers;
+}
+
+export type ServeRepair = { hostPort: string; mount: string; from: number; to: number; proxy: string };
+export type ServeStale = { hostPort: string; mount: string; port: number };
+
+/**
+ * Health check for Tailscale Serve against listeners.json. `repair`: a route on a listener's own
+ * mount that proxies to another port (the listener moved), re-pointed at the listener's port.
+ * `stale`: a route next to a listener's mount (same first path segment, e.g. /rechrome beside
+ * /rechrome/taku) whose port no listener uses — a removed listener's leftover, which answers 502.
+ * Root ("/") mounts are never touched: they could be anything.
+ */
+export function planTailscaleServeRepairs(serveStatus: unknown, listeners: { port: number; prefix?: string }[]): { repair: ServeRepair[]; stale: ServeStale[] } {
+  const ports = new Set(listeners.map(l => l.port));
+  const mounts = new Map<string, number>();
+  for (const l of listeners) {
+    const mount = normalizePrefix(l.prefix).replace(/\/+$/, "");
+    if (mount) mounts.set(mount, l.port);
+  }
+  const roots = new Set([...mounts.keys()].map(m => m.split("/")[1]));
+  const repair: ServeRepair[] = [], stale: ServeStale[] = [];
+  for (const { hostPort, mount, target } of loopbackServeHandlers(serveStatus)) {
+    const port = Number(target.port), want = mounts.get(mount);
+    if (want !== undefined) {
+      if (port !== want) {
+        const proxy = new URL(target); proxy.port = String(want);
+        repair.push({ hostPort, mount, from: port, to: want, proxy: proxy.href.replace(/\/$/, mount === "/" ? "/" : "") });
+      }
+    } else if (mount !== "/" && roots.has(mount.split("/")[1]) && !ports.has(port)) {
+      stale.push({ hostPort, mount, port });
+    }
+  }
+  return { repair, stale };
+}
+
+/** Drop the Serve routes that proxy to a removed listener, so they don't linger answering 502. */
+async function removeTailscaleServeRoutes(listener: { port: number; prefix?: string }): Promise<void> {
+  const binary = tailscaleBinary(), raw = binary && await runTailscale(["serve", "status", "--json"]);
+  if (!binary || !raw) return;
+  let serveStatus: unknown;
+  try { serveStatus = JSON.parse(raw); } catch { return; }
+  const mount = normalizePrefix(listener.prefix).replace(/\/+$/, "") || "/";
+  for (const h of loopbackServeHandlers(serveStatus)) {
+    if (Number(h.target.port) !== listener.port || h.mount !== mount) continue;
+    const args = ["serve", `--https=${h.hostPort.split(/:(?=\d+$)/)[1] ?? "443"}`, `--set-path=${h.mount}`, "off"];
+    const ok = await Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "inherit", windowsHide: true }).exited === 0;
+    console.log(ok ? `Removed its Tailscale Serve route ${h.hostPort}${h.mount}.` : `Remove its Tailscale Serve route yourself: tailscale ${args.join(" ")}`);
+  }
+}
+
+type HealthListener = Pick<Listener, "name" | "port" | "prefix" | "profiles">;
+
+/**
+ * Read-only Tailscale Serve health for the listeners: `absent` (no Tailscale here), `unresponsive`
+ * (installed, but its CLI doesn't answer — e.g. not running, or the Mac app's GUI binary), or
+ * `ok` with each shared listener's route plus the routes to re-point or remove.
+ */
+export type TailscaleHealth =
+  | { state: "absent" }
+  | { state: "unresponsive"; error: string }
+  | { state: "ok"; routes: { listener: string; port: number; url: string | null }[]; repair: ServeRepair[]; stale: ServeStale[] };
+
+export async function inspectTailscaleServe(listeners: HealthListener[]): Promise<TailscaleHealth> {
+  const [serve, status] = await Promise.all([runTailscaleDetailed(["serve", "status", "--json"]), runTailscale(["status", "--json"])]);
+  if (!("output" in serve)) return serve.missing ? { state: "absent" } : { state: "unresponsive", error: serve.error };
+  let serveStatus: unknown, dnsName: string | null = null;
+  try { serveStatus = JSON.parse(serve.output || "null"); } catch { return { state: "unresponsive", error: "`tailscale serve status --json` printed no JSON" }; }
+  try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
+  const routes = listeners.filter(l => l.profiles !== "*")
+    .map(l => ({ listener: l.name, port: l.port, url: findTailscaleServeRoute(dnsName, serveStatus, l.port, normalizePrefix(l.prefix)) }));
+  return { state: "ok", routes, ...planTailscaleServeRepairs(serveStatus, listeners) };
+}
+
+const httpsPortOf = (hostPort: string) => hostPort.split(/:(?=\d+$)/)[1] ?? "443";
+
+/** Problems in a health report, one line each with the command that fixes it; empty when healthy. */
+export function tailscaleHealthProblems(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  if (health.state === "unresponsive") return [`Tailscale is installed but its CLI doesn't answer, so Serve routes go unchecked: ${health.error}`];
+  return [
+    ...health.repair.map(r => `${r.hostPort}${r.mount} proxies to 127.0.0.1:${r.from}, but the listener is on ${r.to} (clients get HTTP 502). Fix: tailscale serve --bg --https=${httpsPortOf(r.hostPort)} --set-path=${r.mount} ${r.proxy}`),
+    ...health.stale.map(st => `${st.hostPort}${st.mount} proxies to 127.0.0.1:${st.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${httpsPortOf(st.hostPort)} --set-path=${st.mount} off`),
+  ];
+}
+
+/** The `tailscale:` block of `rech status` / `rech share ls`: each shared listener's route, then problems. */
+export function formatTailscaleHealth(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  const lines = health.state === "ok"
+    ? health.routes.map(r => r.url ? `✓ ${r.listener} → ${r.url} (127.0.0.1:${r.port})` : `- ${r.listener}: no Tailscale Serve route (fine if another proxy exposes it)`)
+    : [];
+  lines.push(...tailscaleHealthProblems(health).map(p => `⚠ ${p}`));
+  return lines.map((line, i) => `${i ? " ".repeat(11) : "tailscale: "}${line}`);
+}
+
+/**
+ * Daemon health check: keep Tailscale Serve routes pointed at the listeners' current ports.
+ * Re-points a moved listener's route on this node; only reports stale routes (removing a
+ * route is the user's call) and a Tailscale CLI that doesn't answer. Returns log lines, empty
+ * when healthy or Tailscale is absent.
+ */
+export async function checkTailscaleServe(listeners: HealthListener[]): Promise<string[]> {
+  const health = await inspectTailscaleServe(listeners);
+  const binary = tailscaleBinary();
+  if (health.state !== "ok" || !binary) return tailscaleHealthProblems(health).map(p => `tailscale serve: ${p}`);
+  const lines: string[] = [];
+  for (const r of health.repair) {
+    const args = ["serve", "--bg", `--https=${httpsPortOf(r.hostPort)}`, `--set-path=${r.mount}`, r.proxy];
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "pipe", windowsHide: true });
+    const ok = await proc.exited === 0;
+    lines.push(ok
+      ? `tailscale serve: re-pointed ${r.hostPort}${r.mount} from 127.0.0.1:${r.from} to ${r.to}`
+      : `tailscale serve: ${r.hostPort}${r.mount} points at 127.0.0.1:${r.from}, listener is on ${r.to}; re-pointing failed (${(await new Response(proc.stderr).text()).trim()}). Run: tailscale ${args.join(" ")}`);
+  }
+  lines.push(...tailscaleHealthProblems({ ...health, repair: [] }).map(p => `tailscale serve: ${p}`));
+  return lines;
+}
+
 /** The same connection (key and profile) at another base URL, e.g. where a proxy exposes the listener. */
 export function rebaseConnectionUrl(routeUrl: string, localUrl: string): string {
   const local = new URL(localUrl);
@@ -1408,7 +1554,7 @@ async function exposeWithTailscaleServe(listener: Listener): Promise<string | nu
   const mount = prefix === "/" ? "/" : prefix.slice(0, -1);
   const args = ["serve", "--bg", `--set-path=${mount}`, `http://127.0.0.1:${listener.port}${mount === "/" ? "" : mount}`];
   console.error(`Running: tailscale ${args.join(" ")}`);
-  const proc = Bun.spawn([binary, ...args], { stdout: "ignore", stderr: "inherit", windowsHide: true });
+  const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "inherit", windowsHide: true });
   if (await proc.exited !== 0) {
     console.error(`tailscale serve failed. Run it yourself, then rech share again:\n  tailscale ${args.join(" ")}`);
     return null;
@@ -1669,7 +1815,9 @@ async function callServe(
     return JSON.parse(text);
   } catch {
     // Not the daemon answering, e.g. a reverse proxy's 404 because the URL's path prefix is wrong.
-    const detail = `HTTP ${res.status} from ${serviceUrl(url, "run")} is not a rechrome daemon response: ${text.slice(0, 200).trim()}`;
+    let detail = `HTTP ${res.status} from ${serviceUrl(url, "run")} is not a rechrome daemon response: ${text.slice(0, 200).trim()}`;
+    if (res.status === 502 || res.status === 503 || res.status === 504)
+      detail += `\n  The proxy is up but nothing answers behind it: this link's listener was likely removed or moved. Ask its owner for a fresh link (\`rech share\`), then \`rechrome connect <link>\`.`;
     if (throwOnFailure) throw new Error(detail);
     console.error(`[rech] rech-client -> ${serviceUrl(url, "run")}\n  -x: ${detail}`);
     process.exit(1);
@@ -2618,6 +2766,9 @@ async function provisionExtensionToken(opts: {
     `--profile-directory=${profileDir}`,
     `--load-extension=${dist}`,
     `--disable-extensions-except=${dist}`,
+    // Chromium 137+ ignores --load-extension unless this feature is off (Chrome for Testing
+    // too): the extension silently never loads and status.html is an error page.
+    "--disable-features=DisableLoadExtensionCommandLineSwitch",
     "--remote-debugging-port=0",
     "--no-first-run",
     "--no-default-browser-check",
@@ -2625,40 +2776,70 @@ async function provisionExtensionToken(opts: {
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
+  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
+  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
   const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
+  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
+  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
+    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 100; i++) {
+    for (let i = 0; i < 300; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
       if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
     }
-    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json();
+    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await cdp.open();
-    const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+    await within(5000, "Connecting to Chrome DevTools", cdp.open());
+    // Wait for the extension's service worker: if it never shows, the extension didn't load.
+    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
+    let loaded = false;
+    for (let i = 0; i < 50 && !loaded; i++) {
+      const { targetInfos } = await cdp.send("Target.getTargets");
+      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
+      if (!loaded) await Bun.sleep(200);
+    }
+    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
+    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
     const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
     // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false;
+    let ok = false, last = "";
     const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    for (let i = 0; i < 50; i++) {
-      const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId).catch(() => null);
-      if (r?.result?.value === token) { ok = true; break; }
-      await Bun.sleep(100);
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
+      const value = (r as any)?.result?.value;
+      if (value === token) { ok = true; break; }
+      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
+      await Bun.sleep(200);
     }
-    if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/ (is the extension loading?)`);
+    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await cdp.send("Browser.close").catch(() => {});
+    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
+    await within(5000, "Chrome exit", proc.exited).catch(() => {});
   } finally {
     cdp?.close();
+    await stopThrowawayChrome(proc, userDataDir);
+  }
+}
+
+/**
+ * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
+ * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
+ */
+async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
+  if (proc.exitCode === null) {
     try { proc.kill(); } catch {}
-    await proc.exited.catch(() => {});
+    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
+    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
   }
+  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
 }
 
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
@@ -2759,6 +2940,7 @@ async function removeListener(name: string): Promise<void> {
   config.listeners = config.listeners.filter(l => l !== listener);
   await writeListeners(config);
   console.log("Listener removed from configuration; daemon reloads automatically.");
+  await removeTailscaleServeRoutes(listener);
 }
 
 async function resolveProfileKeys(selectors: string[]): Promise<string[]> {
@@ -2851,6 +3033,8 @@ async function urlList(): Promise<void> {
   printTable(rows);
   const wide = config.listeners.filter(l => l.profiles !== "*" && l.profiles.length > 1);
   if (wide.length) console.log(`\nOne key covers several profiles on: ${wide.map(l => `${l.name} (${(l.profiles as string[]).length})`).join(", ")}. Anyone with such a link can use each of them.`);
+  const tailscale = formatTailscaleHealth(await inspectTailscaleServe(config.listeners));
+  if (tailscale.length) console.log(`\n${tailscale.join("\n")}`);
   console.log(`\nPrint a full URL (contains the secret key): rech share <profile>, or rech share --all`);
 }
 
@@ -3302,7 +3486,11 @@ async function status(): Promise<void> {
     : null;
   // Show the URL this client connects to; through a proxy, the daemon's bind is on another port.
   const details = [pingBody?.listener && `listener ${pingBody.listener}`, pingBody?.bind && `bind ${pingBody.bind}`].filter(Boolean).join(", ");
-  console.log(`serve:    ${ping ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}` : `not reachable at ${serviceUrl(url)}`}`);
+  // Any HTTP answer is not the daemon: a proxy's 404/502 means the link's listener is gone or moved.
+  const answered = pingResponse?.ok || pingResponse?.status === 401;
+  console.log(`serve:    ${!ping ? `not reachable at ${serviceUrl(url)}`
+    : answered ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}`
+    : `✗ ${serviceUrl(url)} answers HTTP ${pingResponse?.status ?? ping.status}, not a rechrome daemon — this link's listener was likely removed or moved; ask its host for a fresh link (\`rech share <profile>\`), then \`rech connect '<url>'\``}`);
   if (pingResponse?.status === 401)
     console.log(`auth:     ✗ key rejected — ask the host for a fresh URL (\`rech share <profile>\`), then \`rech connect '<url>'\``);
   // daemonManager().id — there is no PM_BIN constant. Referencing one threw a
@@ -3325,7 +3513,11 @@ async function status(): Promise<void> {
   const current = effective ? await resolveProfileEmail(effective).catch(() => effective) : undefined;
   const allowed = pingBody?.profiles === "*" ? "all registered profiles" : pingBody?.profiles?.join(", ");
   console.log(`profile:  ${current ?? "(none selected; add ?profile= to the URL or pass --profile)"}${allowed ? `  — this listener serves: ${allowed}` : ""}`);
-  if (isHost) console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  if (isHost) {
+    const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+    for (const line of formatTailscaleHealth(await inspectTailscaleServe(listeners))) console.log(line);
+    console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  }
 }
 
 

package/rechrome.ts

@@ -377,20 +377,32 @@ export function buildListenChoices(interfaces: ReturnType<typeof networkInterfac
   return choices.sort((a, b) => rank[a.kind] - rank[b.kind]);
 }
 
+// The Mac app's binary only acts as the CLI when it is told to (or has a terminal): from a
+// daemon it tries to start the GUI and fails. Harmless for the standalone CLI.
+const TAILSCALE_ENV = { ...process.env, TAILSCALE_BE_CLI: "1" };
 const tailscaleBinary = () => Bun.which("tailscale") || (existsSync("/Applications/Tailscale.app/Contents/MacOS/Tailscale") ? "/Applications/Tailscale.app/Contents/MacOS/Tailscale" : null);
 
-/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
-async function runTailscale(args: string[]): Promise<string | null> {
+/** Run the Tailscale CLI read-only: its output, or why it gave none (missing, failed, slow). */
+async function runTailscaleDetailed(args: string[]): Promise<{ output: string } | { error: string; missing?: true }> {
   const binary = tailscaleBinary();
-  if (!binary) return null;
+  if (!binary) return { error: "not installed", missing: true };
   try {
-    const proc = Bun.spawn([binary, ...args], { stdout: "pipe", stderr: "ignore" });
-    const timeout = setTimeout(() => proc.kill(), 2000);
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "pipe" });
+    let timedOut = false;
+    const timeout = setTimeout(() => { timedOut = true; proc.kill(); }, 2000);
     try {
-      const output = await new Response(proc.stdout).text();
-      return await proc.exited === 0 ? output : null;
+      const [output, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+      if (await proc.exited === 0) return { output };
+      const reason = timedOut ? "no answer within 2s" : (stderr.trim() || output.trim()).split("\n")[0] || `exit ${proc.exitCode}`;
+      return { error: `\`tailscale ${args.join(" ")}\`: ${reason}` };
     } finally { clearTimeout(timeout); }
-  } catch { return null; }
+  } catch (error) { return { error: String(error) }; }
+}
+
+/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
+async function runTailscale(args: string[]): Promise<string | null> {
+  const result = await runTailscaleDetailed(args);
+  return "output" in result ? result.output : null;
 }
 
 export async function detectListenChoices(): Promise<ListenChoice[]> {
@@ -445,6 +457,140 @@ export async function detectTailscaleServe(port: number, prefix: string): Promis
   return { dnsName, routeUrl, ...serveMountsAndFunnel(serveStatus, routeUrl ? new URL(routeUrl).hostname : dnsName) };
 }
 
+type ServeHandler = { hostPort: string; mount: string; target: URL };
+
+/** Every Serve route that proxies to a loopback HTTP port. */
+function loopbackServeHandlers(serveStatus: unknown): ServeHandler[] {
+  const web = (serveStatus as { Web?: Record<string, { Handlers?: Record<string, { Proxy?: string }> }> } | null)?.Web ?? {};
+  const handlers: ServeHandler[] = [];
+  for (const [hostPort, config] of Object.entries(web)) {
+    for (const [path, handler] of Object.entries(config.Handlers ?? {})) {
+      if (!handler.Proxy) continue;
+      let target: URL;
+      try { target = new URL(/^[a-z]+:\/\//i.test(handler.Proxy) ? handler.Proxy : `http://${handler.Proxy}`); } catch { continue; }
+      if (!["127.0.0.1", "localhost", "[::1]"].includes(target.hostname) || !target.port) continue;
+      handlers.push({ hostPort, mount: path.replace(/\/+$/, "") || "/", target });
+    }
+  }
+  return handlers;
+}
+
+export type ServeRepair = { hostPort: string; mount: string; from: number; to: number; proxy: string };
+export type ServeStale = { hostPort: string; mount: string; port: number };
+
+/**
+ * Health check for Tailscale Serve against listeners.json. `repair`: a route on a listener's own
+ * mount that proxies to another port (the listener moved), re-pointed at the listener's port.
+ * `stale`: a route next to a listener's mount (same first path segment, e.g. /rechrome beside
+ * /rechrome/taku) whose port no listener uses — a removed listener's leftover, which answers 502.
+ * Root ("/") mounts are never touched: they could be anything.
+ */
+export function planTailscaleServeRepairs(serveStatus: unknown, listeners: { port: number; prefix?: string }[]): { repair: ServeRepair[]; stale: ServeStale[] } {
+  const ports = new Set(listeners.map(l => l.port));
+  const mounts = new Map<string, number>();
+  for (const l of listeners) {
+    const mount = normalizePrefix(l.prefix).replace(/\/+$/, "");
+    if (mount) mounts.set(mount, l.port);
+  }
+  const roots = new Set([...mounts.keys()].map(m => m.split("/")[1]));
+  const repair: ServeRepair[] = [], stale: ServeStale[] = [];
+  for (const { hostPort, mount, target } of loopbackServeHandlers(serveStatus)) {
+    const port = Number(target.port), want = mounts.get(mount);
+    if (want !== undefined) {
+      if (port !== want) {
+        const proxy = new URL(target); proxy.port = String(want);
+        repair.push({ hostPort, mount, from: port, to: want, proxy: proxy.href.replace(/\/$/, mount === "/" ? "/" : "") });
+      }
+    } else if (mount !== "/" && roots.has(mount.split("/")[1]) && !ports.has(port)) {
+      stale.push({ hostPort, mount, port });
+    }
+  }
+  return { repair, stale };
+}
+
+/** Drop the Serve routes that proxy to a removed listener, so they don't linger answering 502. */
+async function removeTailscaleServeRoutes(listener: { port: number; prefix?: string }): Promise<void> {
+  const binary = tailscaleBinary(), raw = binary && await runTailscale(["serve", "status", "--json"]);
+  if (!binary || !raw) return;
+  let serveStatus: unknown;
+  try { serveStatus = JSON.parse(raw); } catch { return; }
+  const mount = normalizePrefix(listener.prefix).replace(/\/+$/, "") || "/";
+  for (const h of loopbackServeHandlers(serveStatus)) {
+    if (Number(h.target.port) !== listener.port || h.mount !== mount) continue;
+    const args = ["serve", `--https=${h.hostPort.split(/:(?=\d+$)/)[1] ?? "443"}`, `--set-path=${h.mount}`, "off"];
+    const ok = await Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "inherit", windowsHide: true }).exited === 0;
+    console.log(ok ? `Removed its Tailscale Serve route ${h.hostPort}${h.mount}.` : `Remove its Tailscale Serve route yourself: tailscale ${args.join(" ")}`);
+  }
+}
+
+type HealthListener = Pick<Listener, "name" | "port" | "prefix" | "profiles">;
+
+/**
+ * Read-only Tailscale Serve health for the listeners: `absent` (no Tailscale here), `unresponsive`
+ * (installed, but its CLI doesn't answer — e.g. not running, or the Mac app's GUI binary), or
+ * `ok` with each shared listener's route plus the routes to re-point or remove.
+ */
+export type TailscaleHealth =
+  | { state: "absent" }
+  | { state: "unresponsive"; error: string }
+  | { state: "ok"; routes: { listener: string; port: number; url: string | null }[]; repair: ServeRepair[]; stale: ServeStale[] };
+
+export async function inspectTailscaleServe(listeners: HealthListener[]): Promise<TailscaleHealth> {
+  const [serve, status] = await Promise.all([runTailscaleDetailed(["serve", "status", "--json"]), runTailscale(["status", "--json"])]);
+  if (!("output" in serve)) return serve.missing ? { state: "absent" } : { state: "unresponsive", error: serve.error };
+  let serveStatus: unknown, dnsName: string | null = null;
+  try { serveStatus = JSON.parse(serve.output || "null"); } catch { return { state: "unresponsive", error: "`tailscale serve status --json` printed no JSON" }; }
+  try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
+  const routes = listeners.filter(l => l.profiles !== "*")
+    .map(l => ({ listener: l.name, port: l.port, url: findTailscaleServeRoute(dnsName, serveStatus, l.port, normalizePrefix(l.prefix)) }));
+  return { state: "ok", routes, ...planTailscaleServeRepairs(serveStatus, listeners) };
+}
+
+const httpsPortOf = (hostPort: string) => hostPort.split(/:(?=\d+$)/)[1] ?? "443";
+
+/** Problems in a health report, one line each with the command that fixes it; empty when healthy. */
+export function tailscaleHealthProblems(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  if (health.state === "unresponsive") return [`Tailscale is installed but its CLI doesn't answer, so Serve routes go unchecked: ${health.error}`];
+  return [
+    ...health.repair.map(r => `${r.hostPort}${r.mount} proxies to 127.0.0.1:${r.from}, but the listener is on ${r.to} (clients get HTTP 502). Fix: tailscale serve --bg --https=${httpsPortOf(r.hostPort)} --set-path=${r.mount} ${r.proxy}`),
+    ...health.stale.map(st => `${st.hostPort}${st.mount} proxies to 127.0.0.1:${st.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${httpsPortOf(st.hostPort)} --set-path=${st.mount} off`),
+  ];
+}
+
+/** The `tailscale:` block of `rech status` / `rech share ls`: each shared listener's route, then problems. */
+export function formatTailscaleHealth(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  const lines = health.state === "ok"
+    ? health.routes.map(r => r.url ? `✓ ${r.listener} → ${r.url} (127.0.0.1:${r.port})` : `- ${r.listener}: no Tailscale Serve route (fine if another proxy exposes it)`)
+    : [];
+  lines.push(...tailscaleHealthProblems(health).map(p => `⚠ ${p}`));
+  return lines.map((line, i) => `${i ? " ".repeat(11) : "tailscale: "}${line}`);
+}
+
+/**
+ * Daemon health check: keep Tailscale Serve routes pointed at the listeners' current ports.
+ * Re-points a moved listener's route on this node; only reports stale routes (removing a
+ * route is the user's call) and a Tailscale CLI that doesn't answer. Returns log lines, empty
+ * when healthy or Tailscale is absent.
+ */
+export async function checkTailscaleServe(listeners: HealthListener[]): Promise<string[]> {
+  const health = await inspectTailscaleServe(listeners);
+  const binary = tailscaleBinary();
+  if (health.state !== "ok" || !binary) return tailscaleHealthProblems(health).map(p => `tailscale serve: ${p}`);
+  const lines: string[] = [];
+  for (const r of health.repair) {
+    const args = ["serve", "--bg", `--https=${httpsPortOf(r.hostPort)}`, `--set-path=${r.mount}`, r.proxy];
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "pipe", windowsHide: true });
+    const ok = await proc.exited === 0;
+    lines.push(ok
+      ? `tailscale serve: re-pointed ${r.hostPort}${r.mount} from 127.0.0.1:${r.from} to ${r.to}`
+      : `tailscale serve: ${r.hostPort}${r.mount} points at 127.0.0.1:${r.from}, listener is on ${r.to}; re-pointing failed (${(await new Response(proc.stderr).text()).trim()}). Run: tailscale ${args.join(" ")}`);
+  }
+  lines.push(...tailscaleHealthProblems({ ...health, repair: [] }).map(p => `tailscale serve: ${p}`));
+  return lines;
+}
+
 /** The same connection (key and profile) at another base URL, e.g. where a proxy exposes the listener. */
 export function rebaseConnectionUrl(routeUrl: string, localUrl: string): string {
   const local = new URL(localUrl);
@@ -1408,7 +1554,7 @@ async function exposeWithTailscaleServe(listener: Listener): Promise<string | nu
   const mount = prefix === "/" ? "/" : prefix.slice(0, -1);
   const args = ["serve", "--bg", `--set-path=${mount}`, `http://127.0.0.1:${listener.port}${mount === "/" ? "" : mount}`];
   console.error(`Running: tailscale ${args.join(" ")}`);
-  const proc = Bun.spawn([binary, ...args], { stdout: "ignore", stderr: "inherit", windowsHide: true });
+  const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "inherit", windowsHide: true });
   if (await proc.exited !== 0) {
     console.error(`tailscale serve failed. Run it yourself, then rech share again:\n  tailscale ${args.join(" ")}`);
     return null;
@@ -1669,7 +1815,9 @@ async function callServe(
     return JSON.parse(text);
   } catch {
     // Not the daemon answering, e.g. a reverse proxy's 404 because the URL's path prefix is wrong.
-    const detail = `HTTP ${res.status} from ${serviceUrl(url, "run")} is not a rechrome daemon response: ${text.slice(0, 200).trim()}`;
+    let detail = `HTTP ${res.status} from ${serviceUrl(url, "run")} is not a rechrome daemon response: ${text.slice(0, 200).trim()}`;
+    if (res.status === 502 || res.status === 503 || res.status === 504)
+      detail += `\n  The proxy is up but nothing answers behind it: this link's listener was likely removed or moved. Ask its owner for a fresh link (\`rech share\`), then \`rechrome connect <link>\`.`;
     if (throwOnFailure) throw new Error(detail);
     console.error(`[rech] rech-client -> ${serviceUrl(url, "run")}\n  -x: ${detail}`);
     process.exit(1);
@@ -2618,6 +2766,9 @@ async function provisionExtensionToken(opts: {
     `--profile-directory=${profileDir}`,
     `--load-extension=${dist}`,
     `--disable-extensions-except=${dist}`,
+    // Chromium 137+ ignores --load-extension unless this feature is off (Chrome for Testing
+    // too): the extension silently never loads and status.html is an error page.
+    "--disable-features=DisableLoadExtensionCommandLineSwitch",
     "--remote-debugging-port=0",
     "--no-first-run",
     "--no-default-browser-check",
@@ -2625,40 +2776,70 @@ async function provisionExtensionToken(opts: {
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
+  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
+  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
   const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
+  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
+  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
+    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 100; i++) {
+    for (let i = 0; i < 300; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
       if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
     }
-    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json();
+    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await cdp.open();
-    const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+    await within(5000, "Connecting to Chrome DevTools", cdp.open());
+    // Wait for the extension's service worker: if it never shows, the extension didn't load.
+    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
+    let loaded = false;
+    for (let i = 0; i < 50 && !loaded; i++) {
+      const { targetInfos } = await cdp.send("Target.getTargets");
+      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
+      if (!loaded) await Bun.sleep(200);
+    }
+    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
+    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
     const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
     // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false;
+    let ok = false, last = "";
     const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    for (let i = 0; i < 50; i++) {
-      const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId).catch(() => null);
-      if (r?.result?.value === token) { ok = true; break; }
-      await Bun.sleep(100);
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
+      const value = (r as any)?.result?.value;
+      if (value === token) { ok = true; break; }
+      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
+      await Bun.sleep(200);
     }
-    if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/ (is the extension loading?)`);
+    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await cdp.send("Browser.close").catch(() => {});
+    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
+    await within(5000, "Chrome exit", proc.exited).catch(() => {});
   } finally {
     cdp?.close();
+    await stopThrowawayChrome(proc, userDataDir);
+  }
+}
+
+/**
+ * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
+ * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
+ */
+async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
+  if (proc.exitCode === null) {
     try { proc.kill(); } catch {}
-    await proc.exited.catch(() => {});
+    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
+    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
   }
+  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
 }
 
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
@@ -2759,6 +2940,7 @@ async function removeListener(name: string): Promise<void> {
   config.listeners = config.listeners.filter(l => l !== listener);
   await writeListeners(config);
   console.log("Listener removed from configuration; daemon reloads automatically.");
+  await removeTailscaleServeRoutes(listener);
 }
 
 async function resolveProfileKeys(selectors: string[]): Promise<string[]> {
@@ -2851,6 +3033,8 @@ async function urlList(): Promise<void> {
   printTable(rows);
   const wide = config.listeners.filter(l => l.profiles !== "*" && l.profiles.length > 1);
   if (wide.length) console.log(`\nOne key covers several profiles on: ${wide.map(l => `${l.name} (${(l.profiles as string[]).length})`).join(", ")}. Anyone with such a link can use each of them.`);
+  const tailscale = formatTailscaleHealth(await inspectTailscaleServe(config.listeners));
+  if (tailscale.length) console.log(`\n${tailscale.join("\n")}`);
   console.log(`\nPrint a full URL (contains the secret key): rech share <profile>, or rech share --all`);
 }
 
@@ -3302,7 +3486,11 @@ async function status(): Promise<void> {
     : null;
   // Show the URL this client connects to; through a proxy, the daemon's bind is on another port.
   const details = [pingBody?.listener && `listener ${pingBody.listener}`, pingBody?.bind && `bind ${pingBody.bind}`].filter(Boolean).join(", ");
-  console.log(`serve:    ${ping ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}` : `not reachable at ${serviceUrl(url)}`}`);
+  // Any HTTP answer is not the daemon: a proxy's 404/502 means the link's listener is gone or moved.
+  const answered = pingResponse?.ok || pingResponse?.status === 401;
+  console.log(`serve:    ${!ping ? `not reachable at ${serviceUrl(url)}`
+    : answered ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}`
+    : `✗ ${serviceUrl(url)} answers HTTP ${pingResponse?.status ?? ping.status}, not a rechrome daemon — this link's listener was likely removed or moved; ask its host for a fresh link (\`rech share <profile>\`), then \`rech connect '<url>'\``}`);
   if (pingResponse?.status === 401)
     console.log(`auth:     ✗ key rejected — ask the host for a fresh URL (\`rech share <profile>\`), then \`rech connect '<url>'\``);
   // daemonManager().id — there is no PM_BIN constant. Referencing one threw a
@@ -3325,7 +3513,11 @@ async function status(): Promise<void> {
   const current = effective ? await resolveProfileEmail(effective).catch(() => effective) : undefined;
   const allowed = pingBody?.profiles === "*" ? "all registered profiles" : pingBody?.profiles?.join(", ");
   console.log(`profile:  ${current ?? "(none selected; add ?profile= to the URL or pass --profile)"}${allowed ? `  — this listener serves: ${allowed}` : ""}`);
-  if (isHost) console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  if (isHost) {
+    const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+    for (const line of formatTailscaleHealth(await inspectTailscaleServe(listeners))) console.log(line);
+    console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  }
 }
 
 

package/serve.js

@@ -17,6 +17,7 @@ import {
   resolvePlaywrightCli,
   readTokenRegistry,
   readChromeProfileCache,
+  checkTailscaleServe,
 } from "./rechrome.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
@@ -1041,4 +1042,19 @@ export async function serve() {
     } finally { reloading = false; }
   }, 1000);
   log("Connection credentials remain in local configuration; listener changes reload automatically");
+  // Keep Tailscale Serve routes on the listeners' current ports: right away, after every listener
+  // change, and every few minutes (routes can be edited by hand). Each finding is logged once.
+  let checkedFor = "", lastReport = "", lastCheck = 0, checking = false;
+  setInterval(async () => {
+    if (checking || (applied === checkedFor && Date.now() - lastCheck < 5 * 60_000)) return;
+    checking = true;
+    try {
+      const listeners = JSON.parse(applied || "[]") as Listener[];
+      const lines = await checkTailscaleServe(listeners);
+      const report = lines.join("\n");
+      if (report && report !== lastReport) for (const line of lines) log(line);
+      lastReport = report; checkedFor = applied; lastCheck = Date.now();
+    } catch (error) { log(`tailscale serve health check failed: ${error}`); }
+    finally { checking = false; }
+  }, 2000);
 }

package/serve.ts

@@ -17,6 +17,7 @@ import {
   resolvePlaywrightCli,
   readTokenRegistry,
   readChromeProfileCache,
+  checkTailscaleServe,
 } from "./rechrome.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
@@ -1041,4 +1042,19 @@ export async function serve() {
     } finally { reloading = false; }
   }, 1000);
   log("Connection credentials remain in local configuration; listener changes reload automatically");
+  // Keep Tailscale Serve routes on the listeners' current ports: right away, after every listener
+  // change, and every few minutes (routes can be edited by hand). Each finding is logged once.
+  let checkedFor = "", lastReport = "", lastCheck = 0, checking = false;
+  setInterval(async () => {
+    if (checking || (applied === checkedFor && Date.now() - lastCheck < 5 * 60_000)) return;
+    checking = true;
+    try {
+      const listeners = JSON.parse(applied || "[]") as Listener[];
+      const lines = await checkTailscaleServe(listeners);
+      const report = lines.join("\n");
+      if (report && report !== lastReport) for (const line of lines) log(line);
+      lastReport = report; checkedFor = applied; lastCheck = Date.now();
+    } catch (error) { log(`tailscale serve health check failed: ${error}`); }
+    finally { checking = false; }
+  }, 2000);
 }