repoburg 1.3.217 → 1.3.218

package/daemon/dist/remote/cloudflared.js

@@ -0,0 +1,239 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultExecutor = exports.CLOUDFLARED_METRICS_PORT = void 0;
+exports.detectPlatform = detectPlatform;
+exports.assetName = assetName;
+exports.installDir = installDir;
+exports.cloudflaredBinaryPath = cloudflaredBinaryPath;
+exports.isInstalled = isInstalled;
+exports.selectChecksum = selectChecksum;
+exports.downloadCloudflared = downloadCloudflared;
+exports.cloudflaredMetricsUrl = cloudflaredMetricsUrl;
+exports.systemdUnitContent = systemdUnitContent;
+exports.launchdPlistContent = launchdPlistContent;
+exports.systemdUnitPath = systemdUnitPath;
+exports.launchdPlistPath = launchdPlistPath;
+exports.installService = installService;
+exports.removeService = removeService;
+exports.isServiceRunning = isServiceRunning;
+/**
+ * cloudflared installer + system service management (user-level, no root).
+ *
+ * Download spec: latest GitHub release asset per platform, verified against
+ * the release's checksums.txt. macOS binaries are shipped as .tgz; the
+ * fallback handles both plain and archived assets.
+ */
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const exec = (0, util_1.promisify)(child_process_1.execFile);
+const RELEASE_BASE = 'https://github.com/cloudflare/cloudflared/releases/latest/download';
+function detectPlatform() {
+    const platform = os_1.default.platform();
+    const arch = os_1.default.arch();
+    if (platform !== 'linux' && platform !== 'darwin') {
+        throw new Error(`Unsupported platform for cloudflared: ${platform}`);
+    }
+    if (arch !== 'x64' && arch !== 'arm64') {
+        throw new Error(`Unsupported architecture for cloudflared: ${arch}`);
+    }
+    return { platform, arch };
+}
+/** Release asset name for a platform (plain binary). */
+function assetName({ platform, arch }) {
+    const osPart = platform === 'darwin' ? 'darwin' : 'linux';
+    const archPart = arch === 'x64' ? 'amd64' : 'arm64';
+    return `cloudflared-${osPart}-${archPart}`;
+}
+function installDir(home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.repoburg', 'bin');
+}
+function cloudflaredBinaryPath(home = os_1.default.homedir()) {
+    return path_1.default.join(installDir(home), 'cloudflared');
+}
+function isInstalled(home = os_1.default.homedir()) {
+    return fs_extra_1.default.existsSync(cloudflaredBinaryPath(home));
+}
+/** Pick the sha256 from the checksums.txt content for an asset. */
+function selectChecksum(checksumsTxt, asset) {
+    const line = checksumsTxt.split('\n').find((entry) => entry.trim().endsWith(asset));
+    const match = line?.match(/^([0-9a-f]{64})\s+\S+$/);
+    return match ? match[1] : null;
+}
+async function fetchText(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`Download failed (${response.status}): ${url}`);
+    return response.text();
+}
+async function fetchBuffer(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`Download failed (${response.status}): ${url}`);
+    return Buffer.from(await response.arrayBuffer());
+}
+/**
+ * Download cloudflared into ~/.repoburg/bin, sha256-verified.
+ * Throws when the checksum does not match — never install an unverified binary.
+ */
+async function downloadCloudflared(options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const platformInfo = options.platform ?? detectPlatform();
+    const asset = assetName(platformInfo);
+    const checksumsTxt = await (async (url) => {
+        const response = await fetchImpl(url);
+        if (!response.ok)
+            throw new Error(`Checksums download failed (${response.status})`);
+        return response.text();
+    })(`${RELEASE_BASE}/cloudflared_checksums.txt`);
+    const expected = selectChecksum(checksumsTxt, asset);
+    if (!expected)
+        throw new Error(`No checksum found for asset ${asset}`);
+    const dir = installDir(home);
+    fs_extra_1.default.ensureDirSync(dir);
+    let binary;
+    const binaryUrl = `${RELEASE_BASE}/${asset}`;
+    const binaryResponse = await fetchImpl(binaryUrl);
+    if (binaryResponse.ok) {
+        binary = Buffer.from(await binaryResponse.arrayBuffer());
+    }
+    else if (platformInfo.platform === 'darwin') {
+        // macOS releases ship as .tgz; extract with the system tar.
+        const tgz = Buffer.from(await (await fetchImpl(`${binaryUrl}.tgz`)).arrayBuffer());
+        const tgzPath = path_1.default.join(dir, `${asset}.tgz`);
+        fs_extra_1.default.writeFileSync(tgzPath, tgz);
+        await exec('tar', ['-xzf', tgzPath, '-C', dir]);
+        fs_extra_1.default.removeSync(tgzPath);
+        const binaryPath = cloudflaredBinaryPath(home);
+        if (!fs_extra_1.default.existsSync(binaryPath))
+            throw new Error('cloudflared extraction produced no binary');
+        return binaryPath;
+    }
+    else {
+        throw new Error(`Binary download failed (${binaryResponse.status})`);
+    }
+    const actual = crypto_1.default.createHash('sha256').update(binary).digest('hex');
+    if (actual !== expected) {
+        throw new Error(`Checksum mismatch for ${asset}: expected ${expected}, got ${actual}`);
+    }
+    const binaryPath = cloudflaredBinaryPath(home);
+    fs_extra_1.default.writeFileSync(binaryPath, binary);
+    fs_extra_1.default.chmodSync(binaryPath, 0o755);
+    return binaryPath;
+}
+// --- System service files (user-level, no root required) ---
+const SERVICE_NAME_LINUX = 'repoburg-cloudflared';
+const SERVICE_ID_DARWIN = 'com.repoburg.cloudflared';
+/** Loopback metrics endpoint (tunnel connectivity is probed from here). */
+exports.CLOUDFLARED_METRICS_PORT = 20241;
+function cloudflaredMetricsUrl() {
+    return `http://127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT}/metrics`;
+}
+function systemdUnitContent(binaryPath, tunnelToken) {
+    return ` [Unit]
+Description=Repoburg remote access tunnel (cloudflared)
+After=network-online.target
+
+[Service]
+ExecStart=${binaryPath} tunnel --metrics 127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT} run --token ${tunnelToken}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`.trimStart();
+}
+function launchdPlistContent(binaryPath, tunnelToken) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${SERVICE_ID_DARWIN}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${binaryPath}</string>
+    <string>tunnel</string>
+    <string>--metrics</string>
+    <string>127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT}</string>
+    <string>run</string>
+    <string>--token</string>
+    <string>${tunnelToken}</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${installDir()}/cloudflared.log</string>
+  <key>StandardErrorPath</key><string>${installDir()}/cloudflared.log</string>
+</dict>
+</plist>
+`;
+}
+function systemdUnitPath(home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.config', 'systemd', 'user', `${SERVICE_NAME_LINUX}.service`);
+}
+function launchdPlistPath(home = os_1.default.homedir()) {
+    return path_1.default.join(home, 'Library', 'LaunchAgents', `${SERVICE_ID_DARWIN}.plist`);
+}
+exports.defaultExecutor = exec;
+/** Write the service file and enable it (idempotent). Returns the service file path. */
+async function installService(tunnelToken, options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    const binaryPath = cloudflaredBinaryPath(home);
+    if (platform === 'darwin') {
+        const plistPath = launchdPlistPath(home);
+        fs_extra_1.default.ensureDirSync(path_1.default.dirname(plistPath));
+        fs_extra_1.default.writeFileSync(plistPath, launchdPlistContent(binaryPath, tunnelToken));
+        await executor('launchctl', ['unload', plistPath]).catch(() => undefined);
+        await executor('launchctl', ['load', plistPath]);
+        return plistPath;
+    }
+    const unitPath = systemdUnitPath(home);
+    fs_extra_1.default.ensureDirSync(path_1.default.dirname(unitPath));
+    fs_extra_1.default.writeFileSync(unitPath, systemdUnitContent(binaryPath, tunnelToken));
+    await executor('systemctl', ['--user', 'daemon-reload']);
+    await executor('systemctl', ['--user', 'enable', '--now', SERVICE_NAME_LINUX]);
+    return unitPath;
+}
+async function removeService(options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    if (platform === 'darwin') {
+        const plistPath = launchdPlistPath(home);
+        if (fs_extra_1.default.existsSync(plistPath)) {
+            await executor('launchctl', ['unload', plistPath]).catch(() => undefined);
+            fs_extra_1.default.removeSync(plistPath);
+        }
+        return;
+    }
+    await executor('systemctl', ['--user', 'disable', '--now', SERVICE_NAME_LINUX]).catch(() => undefined);
+    fs_extra_1.default.removeSync(systemdUnitPath(home));
+}
+async function isServiceRunning(options = {}) {
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    if (platform === 'darwin') {
+        try {
+            const { stdout } = await executor('launchctl', ['list']);
+            return stdout.includes(SERVICE_ID_DARWIN);
+        }
+        catch {
+            return false;
+        }
+    }
+    try {
+        const { stdout } = await executor('systemctl', ['--user', 'is-active', SERVICE_NAME_LINUX]);
+        return stdout.trim() === 'active';
+    }
+    catch {
+        return false;
+    }
+}

package/daemon/dist/remote/cloudflared.spec.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const cloudflared_1 = require("./cloudflared");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmpHome = fs_extra_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'cloudflared-'));
+describe('cloudflared', () => {
+    describe('assetName', () => {
+        it('maps platforms to release asset names', () => {
+            expect((0, cloudflared_1.assetName)({ platform: 'darwin', arch: 'x64' })).toBe('cloudflared-darwin-amd64');
+            expect((0, cloudflared_1.assetName)({ platform: 'darwin', arch: 'arm64' })).toBe('cloudflared-darwin-arm64');
+            expect((0, cloudflared_1.assetName)({ platform: 'linux', arch: 'x64' })).toBe('cloudflared-linux-amd64');
+            expect((0, cloudflared_1.assetName)({ platform: 'linux', arch: 'arm64' })).toBe('cloudflared-linux-arm64');
+        });
+    });
+    describe('selectChecksum', () => {
+        it('finds the sha256 for an asset in checksums.txt', () => {
+            const txt = [
+                `${'a'.repeat(64)} cloudflared-linux-amd64`,
+                `${'b'.repeat(64)} cloudflared-darwin-arm64`,
+            ].join('\n');
+            expect((0, cloudflared_1.selectChecksum)(txt, 'cloudflared-darwin-arm64')).toBe('b'.repeat(64));
+        });
+        it('returns null for unknown assets', () => {
+            expect((0, cloudflared_1.selectChecksum)('aaa111 other-binary', 'cloudflared-linux-amd64')).toBeNull();
+        });
+    });
+    describe('service file content', () => {
+        it('builds a systemd unit running the tunnel with the token and metrics flag', () => {
+            const content = (0, cloudflared_1.systemdUnitContent)('/bin/cloudflared', 'TOKEN123');
+            // --metrics is a TUNNEL-level flag — it must come BEFORE the run
+            // subcommand (verified live: `tunnel run --metrics` is rejected).
+            expect(content).toContain('ExecStart=/bin/cloudflared tunnel --metrics 127.0.0.1:20241 run --token TOKEN123');
+            expect(content).toContain('WantedBy=default.target');
+        });
+        it('builds a launchd plist running the tunnel with the token and metrics flag', () => {
+            const content = (0, cloudflared_1.launchdPlistContent)('/bin/cloudflared', 'TOKEN123');
+            const args = content.split('\n').map((l) => l.trim()).filter((l) => l.startsWith('<string>'));
+            // Metrics flag must precede the `run` subcommand.
+            expect(args.indexOf('<string>tunnel</string>')).toBeLessThan(args.indexOf('<string>run</string>'));
+            expect(content).toContain('<string>--metrics</string>');
+            expect(content).toContain('<string>127.0.0.1:20241</string>');
+            expect(content).toContain('<string>--token</string>');
+            expect(content).toContain('<string>TOKEN123</string>');
+            expect(content).toContain('<key>KeepAlive</key><true/>');
+        });
+        it('exposes the metrics URL on loopback', () => {
+            expect((0, cloudflared_1.cloudflaredMetricsUrl)()).toBe('http://127.0.0.1:20241/metrics');
+        });
+    });
+    describe('downloadCloudflared', () => {
+        const linux = { platform: 'linux', arch: 'x64' };
+        const makeFetch = (sha) => jest.fn(async (url) => {
+            const href = String(url);
+            if (href.endsWith('cloudflared_checksums.txt')) {
+                return { ok: true, text: async () => `${sha} cloudflared-linux-amd64`, status: 200 };
+            }
+            return { ok: true, arrayBuffer: async () => new Uint8Array([1, 2, 3, 4]), status: 200 };
+        });
+        it('downloads, verifies the checksum, and writes the binary', async () => {
+            const sha = require('crypto').createHash('sha256').update(Buffer.from([1, 2, 3, 4])).digest('hex');
+            const binaryPath = await (0, cloudflared_1.downloadCloudflared)({ home: tmpHome, platform: linux, fetchImpl: makeFetch(sha) });
+            expect(binaryPath).toBe((0, cloudflared_1.cloudflaredBinaryPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(binaryPath)).toBe(true);
+        });
+        it('rejects a binary whose checksum does not match', async () => {
+            await expect((0, cloudflared_1.downloadCloudflared)({ home: tmpHome, platform: linux, fetchImpl: makeFetch('0'.repeat(64)) })).rejects.toThrow(/Checksum mismatch/);
+        });
+    });
+    describe('system service', () => {
+        const calls = [];
+        const executor = jest.fn(async (cmd, args) => {
+            calls.push([cmd, ...args]);
+            return { stdout: 'active\n' };
+        });
+        beforeEach(() => {
+            calls.length = 0;
+            executor.mockClear();
+        });
+        it('writes a systemd unit and enables it on linux', async () => {
+            const unitPath = await (0, cloudflared_1.installService)('TOKEN', {
+                home: tmpHome,
+                platform: 'linux',
+                executor: executor,
+            });
+            expect(unitPath).toBe((0, cloudflared_1.systemdUnitPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(unitPath)).toBe(true);
+            expect(calls[0]).toEqual(['systemctl', '--user', 'daemon-reload']);
+            expect(calls[1]).toEqual(['systemctl', '--user', 'enable', '--now', 'repoburg-cloudflared']);
+        });
+        it('writes a launchd plist and loads it on darwin', async () => {
+            const plistPath = await (0, cloudflared_1.installService)('TOKEN', {
+                home: tmpHome,
+                platform: 'darwin',
+                executor: executor,
+            });
+            expect(plistPath).toBe((0, cloudflared_1.launchdPlistPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(plistPath)).toBe(true);
+            expect(calls.at(-1)).toEqual(['launchctl', 'load', plistPath]);
+        });
+        it('reports the systemd service as running when active', async () => {
+            executor.mockResolvedValue({ stdout: 'active\n' });
+            await expect((0, cloudflared_1.isServiceRunning)({ platform: 'linux', executor: executor })).resolves.toBe(true);
+            executor.mockResolvedValue({ stdout: 'inactive\n' });
+            await expect((0, cloudflared_1.isServiceRunning)({ platform: 'linux', executor: executor })).resolves.toBe(false);
+        });
+        it('removes the systemd unit on linux', async () => {
+            await (0, cloudflared_1.installService)('TOKEN', { home: tmpHome, platform: 'linux', executor: executor });
+            await (0, cloudflared_1.removeService)({ home: tmpHome, platform: 'linux', executor: executor });
+            expect(fs_extra_1.default.existsSync((0, cloudflared_1.systemdUnitPath)(tmpHome))).toBe(false);
+        });
+    });
+});

package/daemon/dist/remote/orchestrator.js

@@ -0,0 +1,245 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEnableJob = getEnableJob;
+exports.startEnableJob = startEnableJob;
+exports.runEnable = runEnable;
+/**
+ * Deterministic remote-setup orchestration.
+ *
+ * The daemon itself runs the enable state machine (detect → provision →
+ * install → verify) in the background; the modal only polls GET /remote/enable
+ * and renders the progress. Idempotent by design:
+ *  - tunnel already provisioned → provision is skipped,
+ *  - cloudflared binary already on disk → download is skipped,
+ *  - service already running with live edge connections → everything is
+ *    skipped (the job goes straight to ready).
+ *
+ * When a deterministic step fails, the orchestrator opens a troubleshooting
+ * SESSION on the embedded pane (last used provider/model/cwd combo) with the
+ * diagnostics inlined — the agent then works the problem in the background
+ * while the modal shows "Troubleshooting". No SKILL.md is involved; the
+ * troubleshooting playbook lives in this file.
+ */
+const os_1 = __importDefault(require("os"));
+const tunnel_state_1 = require("./tunnel-state");
+const provisioner_1 = require("./provisioner");
+const cloudflared_1 = require("./cloudflared");
+const probes_1 = require("./probes");
+const DEFAULT_PANE_BASE_URL = 'http://127.0.0.1:9998';
+const DEFAULT_VERIFY_TIMEOUT_MS = 90000;
+const DEFAULT_VERIFY_INTERVAL_MS = 5000;
+/** The single active (or last finished) job — one enable at a time. */
+let currentJob = null;
+function getEnableJob() {
+    return currentJob;
+}
+function log(job, step, message) {
+    job.step = step;
+    job.logs.push({ at: new Date().toISOString(), step, message });
+}
+/**
+ * Kick off the enable job in the background. Throws when a job is already
+ * running. Returns the job snapshot the caller can poll.
+ */
+function startEnableJob(mahlas, deps = {}) {
+    if (currentJob?.state === 'running') {
+        throw Object.assign(new Error('An enable job is already running.'), { statusCode: 409 });
+    }
+    const job = {
+        id: `enable-${Date.now()}`,
+        mahlas,
+        hostname: null,
+        state: 'running',
+        step: 'detect',
+        error: null,
+        troubleshootingSessionId: null,
+        logs: [],
+        startedAt: new Date().toISOString(),
+        finishedAt: null,
+    };
+    currentJob = job;
+    void runEnable(job, deps).catch((error) => {
+        // Catastrophic path — runEnable should never reject, but never leave
+        // the job stuck in 'running'.
+        finishFailed(job, error?.message ?? 'Unknown error');
+    });
+    return job;
+}
+function finishFailed(job, error) {
+    job.state = 'failed';
+    job.step = 'failed';
+    job.error = error;
+    job.finishedAt = new Date().toISOString();
+}
+/** The deterministic state machine. */
+async function runEnable(job, depOverrides = {}) {
+    const d = {
+        loadTunnelState: tunnel_state_1.loadTunnelState,
+        provisionTunnel: provisioner_1.provisionTunnel,
+        isInstalled: cloudflared_1.isInstalled,
+        downloadCloudflared: cloudflared_1.downloadCloudflared,
+        installService: cloudflared_1.installService,
+        isServiceRunning: cloudflared_1.isServiceRunning,
+        isConnected: probes_1.probeTunnelConnected,
+        paneBaseUrl: DEFAULT_PANE_BASE_URL,
+        fetchImpl: fetch,
+        verifyTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        verifyIntervalMs: DEFAULT_VERIFY_INTERVAL_MS,
+        waitImpl: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        ...depOverrides,
+    };
+    try {
+        // ---- detect: idempotent no-op check ----
+        log(job, 'detect', 'Checking the current machine state.');
+        const existing = d.loadTunnelState();
+        const running = await d.isServiceRunning().catch(() => false);
+        const connected = await d.isConnected();
+        if (existing && running && connected) {
+            job.hostname = existing.hostname;
+            log(job, 'ready', `Already remote and connected as ${existing.hostname}. Nothing to do.`);
+            job.state = 'ready';
+            job.finishedAt = new Date().toISOString();
+            return;
+        }
+        // ---- provision (only when no local state exists) ----
+        let state = existing;
+        if (!state) {
+            log(job, 'provision', `Provisioning the tunnel as "${job.mahlas ?? ''}".`);
+            state = await d.provisionTunnel(job.mahlas ?? '');
+            job.hostname = state.hostname;
+        }
+        else {
+            job.hostname = state.hostname;
+            log(job, 'provision', `Tunnel already provisioned (${state.hostname}) — skipping provisioning.`);
+        }
+        // ---- install (only when the service is not running) ----
+        if (!running) {
+            log(job, 'install', 'Installing the cloudflared service.');
+            if (d.isInstalled()) {
+                log(job, 'install', 'cloudflared binary already present — skipping the download.');
+            }
+            else {
+                log(job, 'install', 'Downloading cloudflared (sha256-verified).');
+                await d.downloadCloudflared();
+            }
+            await d.installService(state.tunnelToken);
+            log(job, 'install', 'Service installed and started.');
+        }
+        else {
+            log(job, 'install', 'Service already running — skipping install.');
+        }
+        // ---- verify: live edge connections with a bounded wait ----
+        log(job, 'verify', `Waiting for live edge connections (up to ${Math.round(d.verifyTimeoutMs / 1000)}s).`);
+        const deadline = Date.now() + d.verifyTimeoutMs;
+        for (;;) {
+            const ok = (await d.isConnected()) && (await d.isServiceRunning().catch(() => false));
+            if (ok) {
+                log(job, 'ready', `Machine is reachable at https://${state.hostname}`);
+                job.state = 'ready';
+                job.finishedAt = new Date().toISOString();
+                return;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error('Tunnel did not connect in time — see the cloudflared service logs.');
+            }
+            await d.waitImpl(d.verifyIntervalMs);
+        }
+    }
+    catch (error) {
+        // Deterministic path failed → background troubleshooting via the pane.
+        const message = error?.message ?? 'Unknown error';
+        job.error = message;
+        log(job, 'troubleshooting', `Deterministic setup failed: ${message}`);
+        try {
+            await startTroubleshootingSession(job, d);
+        }
+        catch (troubleshootError) {
+            finishFailed(job, `${message} | troubleshooting failed: ${troubleshootError.message}`);
+        }
+    }
+}
+/**
+ * Open a troubleshooting session with the LAST USED provider/model/cwd combo
+ * and submit the diagnostics prompt. The agent runs autonomously in the
+ * background; the modal surfaces the session.
+ */
+async function startTroubleshootingSession(job, d) {
+    const base = d.paneBaseUrl;
+    const http = d.fetchImpl;
+    // The last used agent: newest session wins (GET /api/sessions is newest-first).
+    const listRes = await http(`${base}/api/sessions`);
+    if (!listRes.ok)
+        throw new Error(`pane sessions list failed: ${listRes.status}`);
+    const sessions = (await listRes.json());
+    const last = sessions[0];
+    if (!last) {
+        throw new Error('no agent sessions on this machine — nothing to troubleshoot with');
+    }
+    const createRes = await http(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            title: 'Remote Setup Troubleshooting',
+            runtime_type: last.runtime_type ?? 'codex',
+            model: last.model ?? null,
+            model_reasoning_effort: last.model_reasoning_effort ?? null,
+            cwd: last.cwd ?? null,
+        }),
+    });
+    if (!createRes.ok)
+        throw new Error(`pane session create failed: ${createRes.status}`);
+    const session = (await createRes.json());
+    const turnRes = await http(`${base}/api/sessions/${session.id}/turns`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ user_prompt: buildTroubleshootingPrompt(job) }),
+    });
+    if (!turnRes.ok)
+        throw new Error(`pane turn submit failed: ${turnRes.status}`);
+    job.troubleshootingSessionId = session.id;
+    job.state = 'troubleshooting';
+    job.finishedAt = new Date().toISOString();
+    log(job, 'troubleshooting', `Troubleshooting session opened (${session.id}) — the agent is working.`);
+}
+/**
+ * Inline diagnostics + playbook for the troubleshooting agent.
+ * SECURITY: never include the tunnel token or any other credential here.
+ */
+function buildTroubleshootingPrompt(job) {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    const tail = job.logs
+        .slice(-12)
+        .map((entry) => `[${entry.step}] ${entry.message}`)
+        .join('\n');
+    const platform = os_1.default.platform();
+    const isMac = platform === 'darwin';
+    return [
+        'The deterministic remote-setup orchestration on this machine FAILED. Fix it autonomously.',
+        '',
+        `Error: ${job.error ?? 'unknown'}`,
+        state
+            ? `Machine: mahlas=${state.mahlas}, hostname=${state.hostname}`
+            : 'Machine: no tunnel state on disk (provisioning may have failed).',
+        `Platform: ${platform}`,
+        '',
+        'Setup log:',
+        tail,
+        '',
+        'Playbook:',
+        '1. Snapshot: curl http://localhost:9998/remote/status',
+        isMac
+            ? '2. Service: launchctl list | grep repoburg ; log: ~/.repoburg/bin/cloudflared.log ; plist: ~/Library/LaunchAgents/com.repoburg.cloudflared.plist'
+            : '2. Service: systemctl --user status repoburg-cloudflared ; journalctl --user -u repoburg-cloudflared',
+        '3. Fix the root cause yourself:',
+        '   - reinstall the service: curl -X POST http://localhost:9998/remote/install',
+        '   - broken tunnel: curl -X DELETE http://localhost:9998/remote/uninstall then curl -X POST -H "Content-Type: application/json" -d \'{"mahlas":"<mahlas>"}\' http://localhost:9998/remote/provision',
+        '   - the mahlas may be taken (409) — pick a close variant and tell the user.',
+        '4. Done when /remote/status reports connection.ok=true and https://<hostname>/health answers.',
+        '5. Stop after 3 failed attempts (~2 minutes) and report findings. Do not loop forever.',
+        '',
+        'Safety: /remote/* works ONLY from localhost curl. Never edit ~/.repoburg/remote.json by hand and never run cloudflared manually. Never print the tunnel token.',
+    ].join('\n');
+}