repoburg 1.3.217 → 1.3.218

package/daemon/dist/remote/orchestrator.spec.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Orchestrator spec — drives runEnable with mock deps; startEnableJob is
+ * covered by the routes spec (mahlas validation + busy 409).
+ */
+const orchestrator_1 = require("./orchestrator");
+jest.mock('./tunnel-state');
+jest.mock('./provisioner');
+jest.mock('./cloudflared');
+jest.mock('./probes');
+const tunnel_state_1 = require("./tunnel-state");
+const cloudflared_1 = require("./cloudflared");
+const probes_1 = require("./probes");
+const mockedLoad = tunnel_state_1.loadTunnelState;
+const mockedIsInstalled = cloudflared_1.isInstalled;
+const mockedConnected = probes_1.probeTunnelConnected;
+const STATE = {
+    mahlas: 'zz',
+    hostname: 'zz.repoburg.com',
+    accountTunnelId: 'acc-1',
+    tunnelToken: 'TUNNELSECRET',
+    accessTeamDomain: 'team.cloudflareaccess.com',
+    accessAud: 'aud',
+    ownerEmail: 'o@x.com',
+    installedAt: '2026-01-01T00:00:00Z',
+};
+/** Wait for a settled microtask chain (the job loop is async). */
+const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
+function makeJob(mahlas = 'newmach') {
+    return {
+        id: 'job-1',
+        mahlas,
+        hostname: null,
+        state: 'running',
+        step: 'detect',
+        error: null,
+        troubleshootingSessionId: null,
+        logs: [],
+        startedAt: new Date().toISOString(),
+        finishedAt: null,
+    };
+}
+function makeDeps(overrides = {}) {
+    return {
+        loadTunnelState: mockedLoad,
+        provisionTunnel: jest.fn().mockResolvedValue(STATE),
+        isInstalled: mockedIsInstalled,
+        downloadCloudflared: jest.fn().mockResolvedValue('/bin/cloudflared'),
+        installService: jest.fn().mockResolvedValue('/service'),
+        isServiceRunning: jest.fn().mockResolvedValue(true),
+        isConnected: mockedConnected,
+        paneBaseUrl: 'http://127.0.0.1:9998',
+        fetchImpl: jest.fn(),
+        verifyTimeoutMs: 60,
+        verifyIntervalMs: 10,
+        waitImpl: jest.fn(async () => undefined),
+        ...overrides,
+    };
+}
+describe('orchestrator: deterministic happy path', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+    it('no-ops when already provisioned, running, and connected', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        mockedConnected.mockResolvedValue(true);
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('ready');
+        expect(deps.provisionTunnel).not.toHaveBeenCalled();
+        expect(deps.installService).not.toHaveBeenCalled();
+        expect(job.logs.some((l) => l.message.includes('Nothing to do'))).toBe(true);
+    });
+    it('provisions, installs, and verifies a fresh machine', async () => {
+        mockedLoad.mockReturnValue(null);
+        mockedIsInstalled.mockReturnValue(false);
+        mockedConnected.mockResolvedValue(true);
+        // Detect: service down (fresh machine). Verify: service up after install.
+        const serviceProbe = jest.fn().mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob('fresh');
+        const deps = makeDeps({ isServiceRunning: serviceProbe });
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.provisionTunnel).toHaveBeenCalledWith('fresh');
+        expect(deps.downloadCloudflared).toHaveBeenCalledTimes(1);
+        expect(deps.installService).toHaveBeenCalledWith('TUNNELSECRET');
+        expect(job.state).toBe('ready');
+        expect(job.logs.some((l) => l.message.includes('reachable at https://zz.repoburg.com'))).toBe(true);
+    });
+    it('skips provision when the tunnel state exists and skips download when the binary is present', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        mockedConnected.mockResolvedValue(true);
+        // Detect: service down → install runs. Verify: service up.
+        const serviceProbe = jest.fn().mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob('ignored');
+        const deps = makeDeps({ isServiceRunning: serviceProbe });
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.provisionTunnel).not.toHaveBeenCalled();
+        expect(deps.downloadCloudflared).not.toHaveBeenCalled();
+        expect(deps.installService).toHaveBeenCalledWith('TUNNELSECRET');
+        expect(job.state).toBe('ready');
+    });
+    it('skips install when the service is already running and waits for connections', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        // First probe: not connected (service warming up); second: connected.
+        mockedConnected.mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob();
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.installService).not.toHaveBeenCalled();
+        expect(job.state).toBe('ready');
+    });
+    it('fails after the verify deadline', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        mockedConnected.mockResolvedValue(false);
+        const job = makeJob();
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('failed'); // no pane sessions available in the mock
+        expect(job.error).toContain('did not connect');
+    });
+});
+describe('orchestrator: troubleshooting fallback', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedLoad.mockReturnValue(null);
+        mockedIsInstalled.mockReturnValue(false);
+        mockedConnected.mockResolvedValue(false);
+    });
+    function paneFetch(jestFn) {
+        // /api/sessions list (newest first), session create, turn submit.
+        jestFn.mockImplementation(async (input, init) => {
+            const url = String(input);
+            if (url.endsWith('/api/sessions') && (!init || init.method === 'GET')) {
+                return {
+                    ok: true,
+                    json: async () => [
+                        { id: 's1', runtime_type: 'repoburg', model: 'glm', model_reasoning_effort: null, cwd: '/repo' },
+                    ],
+                };
+            }
+            if (url.endsWith('/api/sessions') && init?.method === 'POST') {
+                return { ok: true, json: async () => ({ id: 'ts-1' }) };
+            }
+            if (url.includes('/api/sessions/ts-1/turns')) {
+                return { ok: true, json: async () => ({ id: 'turn-1' }) };
+            }
+            throw new Error(`unexpected ${url}`);
+        });
+    }
+    it('opens a troubleshooting session with the last used agent on failure', async () => {
+        const fetchImpl = jest.fn();
+        paneFetch(fetchImpl);
+        const deps = makeDeps({ fetchImpl: fetchImpl });
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('troubleshooting');
+        expect(job.troubleshootingSessionId).toBe('ts-1');
+        // Session created with the LAST USED combo.
+        const createCall = fetchImpl.mock.calls.find((c) => c[1]?.method === 'POST' && String(c[0]).endsWith('/api/sessions'));
+        expect(JSON.parse(createCall[1].body)).toMatchObject({
+            title: 'Remote Setup Troubleshooting',
+            runtime_type: 'repoburg',
+            model: 'glm',
+            cwd: '/repo',
+        });
+        // The prompt carries the playbook but never the tunnel token.
+        const turnCall = fetchImpl.mock.calls.find((c) => String(c[0]).includes('/api/sessions/ts-1/turns'));
+        const prompt = JSON.parse(turnCall[1].body).user_prompt;
+        expect(prompt).toContain('localhost:9998/remote/status');
+        expect(prompt).not.toContain('TUNNELSECRET');
+    });
+    it('fails (no agent) when the pane has no sessions', async () => {
+        const fetchImpl = jest.fn(async () => ({ ok: true, json: async () => [] }));
+        const deps = makeDeps({ fetchImpl: fetchImpl });
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('failed');
+        expect(job.troubleshootingSessionId).toBeNull();
+        expect(job.error).toContain('no agent sessions');
+    });
+    it('getEnableJob returns null before any job', () => {
+        expect((0, orchestrator_1.getEnableJob)()).toBeNull();
+    });
+});

package/daemon/dist/remote/probes.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probePublicHealth = probePublicHealth;
+exports.probeTunnelConnected = probeTunnelConnected;
+/**
+ * Connectivity probes shared by the /remote routes and the enable
+ * orchestrator. Both signals are needed: the public health probe only proves
+ * the edge knows the hostname (CF Access answers 302 before the tunnel is
+ * consulted), while the cloudflared metrics gauge proves live edge
+ * connections through the tunnel.
+ */
+const tunnel_state_1 = require("./tunnel-state");
+const cloudflared_1 = require("./cloudflared");
+const HEALTH_CHECK_TIMEOUT_MS = 10000;
+function publicHealthUrl() {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    return state ? `https://${state.hostname}/health` : null;
+}
+/**
+ * Edge reachability probe. Behind CF Access an anonymous request gets a 302
+ * to the login page BEFORE the tunnel is ever consulted — so this can only
+ * prove the edge knows the hostname, never that the tunnel is connected.
+ * `redirect: 'manual'` prevents the old false positive where the login
+ * page's 200 was counted as a healthy daemon.
+ */
+async function probePublicHealth(timeoutMs = HEALTH_CHECK_TIMEOUT_MS) {
+    const url = publicHealthUrl();
+    if (!url)
+        return false;
+    try {
+        const response = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(timeoutMs) });
+        return response.status >= 200 && response.status < 400;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Tunnel connectivity from cloudflared's LOCAL metrics endpoint. This is the
+ * primary "is the tunnel actually serving" signal: `ha_connections` counts
+ * live edge connections (0 or unreachable metrics = not connected).
+ */
+async function probeTunnelConnected(timeoutMs = HEALTH_CHECK_TIMEOUT_MS) {
+    try {
+        const response = await fetch((0, cloudflared_1.cloudflaredMetricsUrl)(), {
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!response.ok)
+            return false;
+        const body = await response.text();
+        // The gauge may appear label-less (`… 4`) or labeled (`…{region="us"} 4`);
+        // ^… anchors past the HELP/TYPE lines.
+        const match = body.match(/^cloudflared_tunnel_ha_connections(?:\{[^}]*\})?\s+([0-9.]+)/m);
+        return Boolean(match && Number(match[1]) > 0);
+    }
+    catch {
+        return false;
+    }
+}

package/daemon/dist/remote/provisioner.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
+exports.accountServerUrl = accountServerUrl;
+exports.provisionTunnel = provisionTunnel;
+exports.listTunnels = listTunnels;
+exports.uninstallTunnel = uninstallTunnel;
+/**
+ * Account-server client for tunnel lifecycle. The daemon authenticates with
+ * the device JWT from `repoburg login` (~/.repoburg/token.jwt).
+ */
+const authManager_1 = require("../auth/authManager");
+const tunnel_state_1 = require("./tunnel-state");
+const isDevelopment = process.env.NODE_ENV === 'development';
+const DEFAULT_ACCOUNT_SERVER_URL = isDevelopment
+    ? 'http://localhost:2999'
+    : 'https://repoburg.com/api/account';
+function accountServerUrl() {
+    return process.env.ACCOUNT_SERVER_URL ?? DEFAULT_ACCOUNT_SERVER_URL;
+}
+class ProvisioningError extends Error {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+exports.ProvisioningError = ProvisioningError;
+async function callAccountServer(method, path, token, body) {
+    const response = await fetch(`${accountServerUrl()}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const data = (await response.json().catch(() => ({})));
+    if (!response.ok) {
+        const message = data.message ?? data.error ?? response.statusText;
+        throw new ProvisioningError(`Account server: ${message}`, response.status);
+    }
+    return data;
+}
+/**
+ * Provision a new tunnel for this machine and persist the state locally.
+ * The response's tunnel_token is the only credential written to disk.
+ */
+async function provisionTunnel(mahlas) {
+    const token = await authManager_1.authManager.readToken();
+    if (!token) {
+        throw new ProvisioningError('Not logged in. Run `repoburg login` first.', 401);
+    }
+    const result = await callAccountServer('POST', '/device/tunnels', token, { mahlas });
+    // Access config + owner email arrive in the same response: the tunnel is
+    // email-gated from birth, and checkRemoteAuth can pin the owner's email.
+    const state = {
+        mahlas: result.mahlas,
+        hostname: result.hostname,
+        accountTunnelId: result.id,
+        tunnelToken: result.tunnel_token,
+        accessTeamDomain: result.accessTeamDomain,
+        accessAud: result.accessAud,
+        ownerEmail: result.ownerEmail,
+        installedAt: new Date().toISOString(),
+    };
+    (0, tunnel_state_1.saveTunnelState)(state);
+    return state;
+}
+/** List this user's machines (used by the pane machine list when local). */
+async function listTunnels() {
+    const token = await authManager_1.authManager.readToken();
+    if (!token)
+        return [];
+    return callAccountServer('GET', '/device/tunnels', token);
+}
+/** Remove the tunnel on the account server and wipe the local state. */
+async function uninstallTunnel() {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    if (!state)
+        return;
+    const token = await authManager_1.authManager.readToken();
+    if (token) {
+        await callAccountServer('DELETE', `/device/tunnels/${state.accountTunnelId}`, token);
+    }
+    (0, tunnel_state_1.clearTunnelState)();
+}

package/daemon/dist/remote/provisioner.spec.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const provisioner_1 = require("./provisioner");
+const tunnel_state_1 = require("./tunnel-state");
+const authManager_1 = require("../auth/authManager");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmpHome = fs_extra_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'provisioner-'));
+process.env.ACCOUNT_SERVER_URL = 'http://account-server.test';
+jest.mock('../auth/authManager', () => ({
+    authManager: { readToken: jest.fn() },
+}));
+const mockedReadToken = authManager_1.authManager.readToken;
+afterEach(() => {
+    (0, tunnel_state_1.clearTunnelState)(tmpHome);
+    mockedReadToken.mockReset();
+});
+describe('provisioner', () => {
+    it('provisions a tunnel and persists only the machine-local state', async () => {
+        mockedReadToken.mockResolvedValue('device-jwt');
+        const fetchMock = jest.fn(async () => ({
+            ok: true,
+            status: 200,
+            json: async () => ({
+                id: 'tunnel-uuid',
+                mahlas: 'workstation',
+                hostname: 'workstation.repoburg.com',
+                tunnel_token: 'connector-token',
+                accessTeamDomain: 'team.cloudflareaccess.com',
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            }),
+        }));
+        global.fetch = fetchMock;
+        const origHomedir = os_1.default.homedir;
+        os_1.default.homedir = () => tmpHome;
+        try {
+            const state = await (0, provisioner_1.provisionTunnel)('workstation');
+            expect(state).toMatchObject({
+                mahlas: 'workstation',
+                hostname: 'workstation.repoburg.com',
+                accountTunnelId: 'tunnel-uuid',
+                tunnelToken: 'connector-token',
+                accessTeamDomain: 'team.cloudflareaccess.com',
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            });
+            expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toMatchObject({
+                accountTunnelId: 'tunnel-uuid',
+                // The Access config arrives with the tunnel — email-gated from birth.
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            });
+            const [url, init] = fetchMock.mock.calls[0];
+            expect(url).toBe('http://account-server.test/device/tunnels');
+            expect(init.headers.Authorization).toBe('Bearer device-jwt');
+        }
+        finally {
+            os_1.default.homedir = origHomedir;
+        }
+    });
+    it('refuses to provision when not logged in', async () => {
+        mockedReadToken.mockResolvedValue(null);
+        await expect((0, provisioner_1.provisionTunnel)('workstation')).rejects.toBeInstanceOf(provisioner_1.ProvisioningError);
+    });
+    it('surfaces account-server errors', async () => {
+        mockedReadToken.mockResolvedValue('device-jwt');
+        global.fetch = jest.fn(async () => ({
+            ok: false,
+            status: 409,
+            json: async () => ({ message: 'Mahlas already taken' }),
+        }));
+        await expect((0, provisioner_1.provisionTunnel)('workstation')).rejects.toThrow(/already taken/);
+    });
+    it('uninstalls the tunnel on the server and clears local state', async () => {
+        (0, tunnel_state_1.saveTunnelState)({
+            mahlas: 'workstation',
+            hostname: 'workstation.repoburg.com',
+            accountTunnelId: 'tunnel-uuid',
+            tunnelToken: 'connector-token',
+        }, tmpHome);
+        mockedReadToken.mockResolvedValue('device-jwt');
+        const fetchMock = jest.fn(async () => ({ ok: true, status: 200, json: async () => ({}) }));
+        global.fetch = fetchMock;
+        const origHomedir = os_1.default.homedir;
+        os_1.default.homedir = () => tmpHome;
+        try {
+            await (0, provisioner_1.uninstallTunnel)();
+            expect(fetchMock.mock.calls[0][0]).toBe('http://account-server.test/device/tunnels/tunnel-uuid');
+            expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toBeNull();
+        }
+        finally {
+            os_1.default.homedir = origHomedir;
+        }
+    });
+    it('lists tunnels only when logged in', async () => {
+        mockedReadToken.mockResolvedValue(null);
+        await expect((0, provisioner_1.listTunnels)()).resolves.toEqual([]);
+    });
+});

package/daemon/dist/remote/routes.js

@@ -0,0 +1,155 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRemoteRouter = createRemoteRouter;
+const express_1 = require("express");
+const tunnel_state_1 = require("./tunnel-state");
+const provisioner_1 = require("./provisioner");
+const probes_1 = require("./probes");
+const orchestrator_1 = require("./orchestrator");
+const cloudflared_1 = require("./cloudflared");
+const os_1 = __importDefault(require("os"));
+/**
+ * Local-only tunnel lifecycle API.
+ *
+ * SECURITY: this router must NEVER be reachable through the tunnel. The
+ * account-server blocks `^/remote(/.*)?$` at the CF ingress edge (404), and
+ * these endpoints manage the machine itself.
+ */
+function errorResponse(res, error) {
+    // Account-server errors carry a meaningful HTTP status (ProvisioningError).
+    const statusCode = error.statusCode;
+    const message = error.message ?? 'Unknown error';
+    if (typeof statusCode === 'number' && statusCode >= 400 && statusCode < 600) {
+        res.status(statusCode).json({ error: message });
+        return;
+    }
+    res.status(500).json({ error: message });
+}
+function createRemoteRouter() {
+    const router = (0, express_1.Router)();
+    // Full status snapshot for the skill's first diagnostic step.
+    router.get('/status', async (_req, res) => {
+        const state = (0, tunnel_state_1.loadTunnelState)();
+        const platformSupported = ['linux', 'darwin'].includes(os_1.default.platform());
+        res.json({
+            daemonRunning: true,
+            platform: os_1.default.platform(),
+            platformSupported,
+            tunnel: state
+                ? { mahlas: state.mahlas, hostname: state.hostname, provisioned: true }
+                : { provisioned: false },
+            cloudflared: { installed: (0, cloudflared_1.isInstalled)() },
+            service: { running: await (0, cloudflared_1.isServiceRunning)().catch(() => false) },
+            connection: { ok: await (0, probes_1.probeTunnelConnected)() },
+            access: {
+                configured: Boolean(state?.accessTeamDomain && state?.accessAud),
+                ownerEmail: state?.ownerEmail ?? null,
+                teamDomain: state?.accessTeamDomain ?? null,
+            },
+            publicHealth: { ok: await (0, probes_1.probePublicHealth)() },
+        });
+    });
+    // Create the tunnel on the account server; state saved, nothing installed yet.
+    router.post('/provision', async (req, res) => {
+        const mahlas = req.body?.mahlas;
+        if (typeof mahlas !== 'string' || mahlas.length === 0) {
+            res.status(400).json({ error: 'Body must include { "mahlas": "..." }' });
+            return;
+        }
+        try {
+            const state = await (0, provisioner_1.provisionTunnel)(mahlas);
+            res.json({
+                mahlas: state.mahlas,
+                hostname: state.hostname,
+                message: 'Tunnel provisioned. Next: POST /remote/install.',
+            });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Download cloudflared + install + start the system service.
+    router.post('/install', async (_req, res) => {
+        const state = (0, tunnel_state_1.loadTunnelState)();
+        if (!state) {
+            res.status(409).json({ error: 'No tunnel provisioned. Call POST /remote/provision first.' });
+            return;
+        }
+        try {
+            if (!(0, cloudflared_1.isInstalled)()) {
+                await (0, cloudflared_1.downloadCloudflared)();
+            }
+            const servicePath = await (0, cloudflared_1.installService)(state.tunnelToken);
+            const running = await (0, cloudflared_1.isServiceRunning)();
+            // Primary verification: live edge connections from cloudflared metrics.
+            // The edge probe alone is meaningless behind CF Access (always 302).
+            const connected = await (0, probes_1.probeTunnelConnected)();
+            res.json({
+                installed: true,
+                servicePath,
+                running,
+                connection: { ok: connected },
+                message: connected
+                    ? `Machine is reachable at https://${state.hostname}`
+                    : 'Service started but the tunnel has no live connections — check service logs.',
+            });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Stop the tunnel service but keep the provisioned tunnel.
+    router.post('/disable', async (_req, res) => {
+        try {
+            await (0, cloudflared_1.removeService)();
+            res.json({ disabled: true });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Remove service + tunnel (account server) + local state.
+    router.delete('/uninstall', async (_req, res) => {
+        try {
+            await (0, cloudflared_1.removeService)();
+            await (0, provisioner_1.uninstallTunnel)();
+            (0, tunnel_state_1.clearTunnelState)();
+            res.json({ uninstalled: true });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Deterministic enable orchestration — the daemon runs provision/install/
+    // verify itself; the UI only polls GET /remote/enable.
+    const MAHLAS_RE = /^[a-z][a-z0-9-]{1,30}$/;
+    router.post('/enable', (req, res) => {
+        const mahlas = req.body?.mahlas;
+        if (typeof mahlas !== 'string' || !MAHLAS_RE.test(mahlas)) {
+            res.status(400).json({ error: 'Body must include { "mahlas": "..." } (a-z, 0-9, "-").' });
+            return;
+        }
+        try {
+            res.json((0, orchestrator_1.startEnableJob)(mahlas));
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    router.get('/enable', (_req, res) => {
+        res.json((0, orchestrator_1.getEnableJob)());
+    });
+    // Machine list from the account server (for the pane machine switcher).
+    router.get('/machines', async (_req, res) => {
+        try {
+            res.json(await (0, provisioner_1.listTunnels)());
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    return router;
+}