repoburg 1.3.217 → 1.3.219

package/daemon/dist/remote/orchestrator.js

@@ -0,0 +1,245 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEnableJob = getEnableJob;
+exports.startEnableJob = startEnableJob;
+exports.runEnable = runEnable;
+/**
+ * Deterministic remote-setup orchestration.
+ *
+ * The daemon itself runs the enable state machine (detect → provision →
+ * install → verify) in the background; the modal only polls GET /remote/enable
+ * and renders the progress. Idempotent by design:
+ *  - tunnel already provisioned → provision is skipped,
+ *  - cloudflared binary already on disk → download is skipped,
+ *  - service already running with live edge connections → everything is
+ *    skipped (the job goes straight to ready).
+ *
+ * When a deterministic step fails, the orchestrator opens a troubleshooting
+ * SESSION on the embedded pane (last used provider/model/cwd combo) with the
+ * diagnostics inlined — the agent then works the problem in the background
+ * while the modal shows "Troubleshooting". No SKILL.md is involved; the
+ * troubleshooting playbook lives in this file.
+ */
+const os_1 = __importDefault(require("os"));
+const tunnel_state_1 = require("./tunnel-state");
+const provisioner_1 = require("./provisioner");
+const cloudflared_1 = require("./cloudflared");
+const probes_1 = require("./probes");
+const DEFAULT_PANE_BASE_URL = 'http://127.0.0.1:9998';
+const DEFAULT_VERIFY_TIMEOUT_MS = 90000;
+const DEFAULT_VERIFY_INTERVAL_MS = 5000;
+/** The single active (or last finished) job — one enable at a time. */
+let currentJob = null;
+function getEnableJob() {
+    return currentJob;
+}
+function log(job, step, message) {
+    job.step = step;
+    job.logs.push({ at: new Date().toISOString(), step, message });
+}
+/**
+ * Kick off the enable job in the background. Throws when a job is already
+ * running. Returns the job snapshot the caller can poll.
+ */
+function startEnableJob(mahlas, deps = {}) {
+    if (currentJob?.state === 'running') {
+        throw Object.assign(new Error('An enable job is already running.'), { statusCode: 409 });
+    }
+    const job = {
+        id: `enable-${Date.now()}`,
+        mahlas,
+        hostname: null,
+        state: 'running',
+        step: 'detect',
+        error: null,
+        troubleshootingSessionId: null,
+        logs: [],
+        startedAt: new Date().toISOString(),
+        finishedAt: null,
+    };
+    currentJob = job;
+    void runEnable(job, deps).catch((error) => {
+        // Catastrophic path — runEnable should never reject, but never leave
+        // the job stuck in 'running'.
+        finishFailed(job, error?.message ?? 'Unknown error');
+    });
+    return job;
+}
+function finishFailed(job, error) {
+    job.state = 'failed';
+    job.step = 'failed';
+    job.error = error;
+    job.finishedAt = new Date().toISOString();
+}
+/** The deterministic state machine. */
+async function runEnable(job, depOverrides = {}) {
+    const d = {
+        loadTunnelState: tunnel_state_1.loadTunnelState,
+        provisionTunnel: provisioner_1.provisionTunnel,
+        isInstalled: cloudflared_1.isInstalled,
+        downloadCloudflared: cloudflared_1.downloadCloudflared,
+        installService: cloudflared_1.installService,
+        isServiceRunning: cloudflared_1.isServiceRunning,
+        isConnected: probes_1.probeTunnelConnected,
+        paneBaseUrl: DEFAULT_PANE_BASE_URL,
+        fetchImpl: fetch,
+        verifyTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        verifyIntervalMs: DEFAULT_VERIFY_INTERVAL_MS,
+        waitImpl: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        ...depOverrides,
+    };
+    try {
+        // ---- detect: idempotent no-op check ----
+        log(job, 'detect', 'Checking the current machine state.');
+        const existing = d.loadTunnelState();
+        const running = await d.isServiceRunning().catch(() => false);
+        const connected = await d.isConnected();
+        if (existing && running && connected) {
+            job.hostname = existing.hostname;
+            log(job, 'ready', `Already remote and connected as ${existing.hostname}. Nothing to do.`);
+            job.state = 'ready';
+            job.finishedAt = new Date().toISOString();
+            return;
+        }
+        // ---- provision (only when no local state exists) ----
+        let state = existing;
+        if (!state) {
+            log(job, 'provision', `Provisioning the tunnel as "${job.mahlas ?? ''}".`);
+            state = await d.provisionTunnel(job.mahlas ?? '');
+            job.hostname = state.hostname;
+        }
+        else {
+            job.hostname = state.hostname;
+            log(job, 'provision', `Tunnel already provisioned (${state.hostname}) — skipping provisioning.`);
+        }
+        // ---- install (only when the service is not running) ----
+        if (!running) {
+            log(job, 'install', 'Installing the cloudflared service.');
+            if (d.isInstalled()) {
+                log(job, 'install', 'cloudflared binary already present — skipping the download.');
+            }
+            else {
+                log(job, 'install', 'Downloading cloudflared (sha256-verified).');
+                await d.downloadCloudflared();
+            }
+            await d.installService(state.tunnelToken);
+            log(job, 'install', 'Service installed and started.');
+        }
+        else {
+            log(job, 'install', 'Service already running — skipping install.');
+        }
+        // ---- verify: live edge connections with a bounded wait ----
+        log(job, 'verify', `Waiting for live edge connections (up to ${Math.round(d.verifyTimeoutMs / 1000)}s).`);
+        const deadline = Date.now() + d.verifyTimeoutMs;
+        for (;;) {
+            const ok = (await d.isConnected()) && (await d.isServiceRunning().catch(() => false));
+            if (ok) {
+                log(job, 'ready', `Machine is reachable at https://${state.hostname}`);
+                job.state = 'ready';
+                job.finishedAt = new Date().toISOString();
+                return;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error('Tunnel did not connect in time — see the cloudflared service logs.');
+            }
+            await d.waitImpl(d.verifyIntervalMs);
+        }
+    }
+    catch (error) {
+        // Deterministic path failed → background troubleshooting via the pane.
+        const message = error?.message ?? 'Unknown error';
+        job.error = message;
+        log(job, 'troubleshooting', `Deterministic setup failed: ${message}`);
+        try {
+            await startTroubleshootingSession(job, d);
+        }
+        catch (troubleshootError) {
+            finishFailed(job, `${message} | troubleshooting failed: ${troubleshootError.message}`);
+        }
+    }
+}
+/**
+ * Open a troubleshooting session with the LAST USED provider/model/cwd combo
+ * and submit the diagnostics prompt. The agent runs autonomously in the
+ * background; the modal surfaces the session.
+ */
+async function startTroubleshootingSession(job, d) {
+    const base = d.paneBaseUrl;
+    const http = d.fetchImpl;
+    // The last used agent: newest session wins (GET /api/sessions is newest-first).
+    const listRes = await http(`${base}/api/sessions`);
+    if (!listRes.ok)
+        throw new Error(`pane sessions list failed: ${listRes.status}`);
+    const sessions = (await listRes.json());
+    const last = sessions[0];
+    if (!last) {
+        throw new Error('no agent sessions on this machine — nothing to troubleshoot with');
+    }
+    const createRes = await http(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            title: 'Remote Setup Troubleshooting',
+            runtime_type: last.runtime_type ?? 'codex',
+            model: last.model ?? null,
+            model_reasoning_effort: last.model_reasoning_effort ?? null,
+            cwd: last.cwd ?? null,
+        }),
+    });
+    if (!createRes.ok)
+        throw new Error(`pane session create failed: ${createRes.status}`);
+    const session = (await createRes.json());
+    const turnRes = await http(`${base}/api/sessions/${session.id}/turns`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ user_prompt: buildTroubleshootingPrompt(job) }),
+    });
+    if (!turnRes.ok)
+        throw new Error(`pane turn submit failed: ${turnRes.status}`);
+    job.troubleshootingSessionId = session.id;
+    job.state = 'troubleshooting';
+    job.finishedAt = new Date().toISOString();
+    log(job, 'troubleshooting', `Troubleshooting session opened (${session.id}) — the agent is working.`);
+}
+/**
+ * Inline diagnostics + playbook for the troubleshooting agent.
+ * SECURITY: never include the tunnel token or any other credential here.
+ */
+function buildTroubleshootingPrompt(job) {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    const tail = job.logs
+        .slice(-12)
+        .map((entry) => `[${entry.step}] ${entry.message}`)
+        .join('\n');
+    const platform = os_1.default.platform();
+    const isMac = platform === 'darwin';
+    return [
+        'The deterministic remote-setup orchestration on this machine FAILED. Fix it autonomously.',
+        '',
+        `Error: ${job.error ?? 'unknown'}`,
+        state
+            ? `Machine: mahlas=${state.mahlas}, hostname=${state.hostname}`
+            : 'Machine: no tunnel state on disk (provisioning may have failed).',
+        `Platform: ${platform}`,
+        '',
+        'Setup log:',
+        tail,
+        '',
+        'Playbook:',
+        '1. Snapshot: curl http://localhost:9998/remote/status',
+        isMac
+            ? '2. Service: launchctl list | grep repoburg ; log: ~/.repoburg/bin/cloudflared.log ; plist: ~/Library/LaunchAgents/com.repoburg.cloudflared.plist'
+            : '2. Service: systemctl --user status repoburg-cloudflared ; journalctl --user -u repoburg-cloudflared',
+        '3. Fix the root cause yourself:',
+        '   - reinstall the service: curl -X POST http://localhost:9998/remote/install',
+        '   - broken tunnel: curl -X DELETE http://localhost:9998/remote/uninstall then curl -X POST -H "Content-Type: application/json" -d \'{"mahlas":"<mahlas>"}\' http://localhost:9998/remote/provision',
+        '   - the mahlas may be taken (409) — pick a close variant and tell the user.',
+        '4. Done when /remote/status reports connection.ok=true and https://<hostname>/health answers.',
+        '5. Stop after 3 failed attempts (~2 minutes) and report findings. Do not loop forever.',
+        '',
+        'Safety: /remote/* works ONLY from localhost curl. Never edit ~/.repoburg/remote.json by hand and never run cloudflared manually. Never print the tunnel token.',
+    ].join('\n');
+}

package/daemon/dist/remote/orchestrator.spec.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Orchestrator spec — drives runEnable with mock deps; startEnableJob is
+ * covered by the routes spec (mahlas validation + busy 409).
+ */
+const orchestrator_1 = require("./orchestrator");
+jest.mock('./tunnel-state');
+jest.mock('./provisioner');
+jest.mock('./cloudflared');
+jest.mock('./probes');
+const tunnel_state_1 = require("./tunnel-state");
+const cloudflared_1 = require("./cloudflared");
+const probes_1 = require("./probes");
+const mockedLoad = tunnel_state_1.loadTunnelState;
+const mockedIsInstalled = cloudflared_1.isInstalled;
+const mockedConnected = probes_1.probeTunnelConnected;
+const STATE = {
+    mahlas: 'zz',
+    hostname: 'zz.repoburg.com',
+    accountTunnelId: 'acc-1',
+    tunnelToken: 'TUNNELSECRET',
+    accessTeamDomain: 'team.cloudflareaccess.com',
+    accessAud: 'aud',
+    ownerEmail: 'o@x.com',
+    installedAt: '2026-01-01T00:00:00Z',
+};
+/** Wait for a settled microtask chain (the job loop is async). */
+const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
+function makeJob(mahlas = 'newmach') {
+    return {
+        id: 'job-1',
+        mahlas,
+        hostname: null,
+        state: 'running',
+        step: 'detect',
+        error: null,
+        troubleshootingSessionId: null,
+        logs: [],
+        startedAt: new Date().toISOString(),
+        finishedAt: null,
+    };
+}
+function makeDeps(overrides = {}) {
+    return {
+        loadTunnelState: mockedLoad,
+        provisionTunnel: jest.fn().mockResolvedValue(STATE),
+        isInstalled: mockedIsInstalled,
+        downloadCloudflared: jest.fn().mockResolvedValue('/bin/cloudflared'),
+        installService: jest.fn().mockResolvedValue('/service'),
+        isServiceRunning: jest.fn().mockResolvedValue(true),
+        isConnected: mockedConnected,
+        paneBaseUrl: 'http://127.0.0.1:9998',
+        fetchImpl: jest.fn(),
+        verifyTimeoutMs: 60,
+        verifyIntervalMs: 10,
+        waitImpl: jest.fn(async () => undefined),
+        ...overrides,
+    };
+}
+describe('orchestrator: deterministic happy path', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+    it('no-ops when already provisioned, running, and connected', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        mockedConnected.mockResolvedValue(true);
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('ready');
+        expect(deps.provisionTunnel).not.toHaveBeenCalled();
+        expect(deps.installService).not.toHaveBeenCalled();
+        expect(job.logs.some((l) => l.message.includes('Nothing to do'))).toBe(true);
+    });
+    it('provisions, installs, and verifies a fresh machine', async () => {
+        mockedLoad.mockReturnValue(null);
+        mockedIsInstalled.mockReturnValue(false);
+        mockedConnected.mockResolvedValue(true);
+        // Detect: service down (fresh machine). Verify: service up after install.
+        const serviceProbe = jest.fn().mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob('fresh');
+        const deps = makeDeps({ isServiceRunning: serviceProbe });
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.provisionTunnel).toHaveBeenCalledWith('fresh');
+        expect(deps.downloadCloudflared).toHaveBeenCalledTimes(1);
+        expect(deps.installService).toHaveBeenCalledWith('TUNNELSECRET');
+        expect(job.state).toBe('ready');
+        expect(job.logs.some((l) => l.message.includes('reachable at https://zz.repoburg.com'))).toBe(true);
+    });
+    it('skips provision when the tunnel state exists and skips download when the binary is present', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        mockedConnected.mockResolvedValue(true);
+        // Detect: service down → install runs. Verify: service up.
+        const serviceProbe = jest.fn().mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob('ignored');
+        const deps = makeDeps({ isServiceRunning: serviceProbe });
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.provisionTunnel).not.toHaveBeenCalled();
+        expect(deps.downloadCloudflared).not.toHaveBeenCalled();
+        expect(deps.installService).toHaveBeenCalledWith('TUNNELSECRET');
+        expect(job.state).toBe('ready');
+    });
+    it('skips install when the service is already running and waits for connections', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        // First probe: not connected (service warming up); second: connected.
+        mockedConnected.mockResolvedValueOnce(false).mockResolvedValue(true);
+        const job = makeJob();
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(deps.installService).not.toHaveBeenCalled();
+        expect(job.state).toBe('ready');
+    });
+    it('fails after the verify deadline', async () => {
+        mockedLoad.mockReturnValue(STATE);
+        mockedIsInstalled.mockReturnValue(true);
+        mockedConnected.mockResolvedValue(false);
+        const job = makeJob();
+        const deps = makeDeps();
+        deps.isServiceRunning.mockResolvedValue(true);
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('failed'); // no pane sessions available in the mock
+        expect(job.error).toContain('did not connect');
+    });
+});
+describe('orchestrator: troubleshooting fallback', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedLoad.mockReturnValue(null);
+        mockedIsInstalled.mockReturnValue(false);
+        mockedConnected.mockResolvedValue(false);
+    });
+    function paneFetch(jestFn) {
+        // /api/sessions list (newest first), session create, turn submit.
+        jestFn.mockImplementation(async (input, init) => {
+            const url = String(input);
+            if (url.endsWith('/api/sessions') && (!init || init.method === 'GET')) {
+                return {
+                    ok: true,
+                    json: async () => [
+                        { id: 's1', runtime_type: 'repoburg', model: 'glm', model_reasoning_effort: null, cwd: '/repo' },
+                    ],
+                };
+            }
+            if (url.endsWith('/api/sessions') && init?.method === 'POST') {
+                return { ok: true, json: async () => ({ id: 'ts-1' }) };
+            }
+            if (url.includes('/api/sessions/ts-1/turns')) {
+                return { ok: true, json: async () => ({ id: 'turn-1' }) };
+            }
+            throw new Error(`unexpected ${url}`);
+        });
+    }
+    it('opens a troubleshooting session with the last used agent on failure', async () => {
+        const fetchImpl = jest.fn();
+        paneFetch(fetchImpl);
+        const deps = makeDeps({ fetchImpl: fetchImpl });
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('troubleshooting');
+        expect(job.troubleshootingSessionId).toBe('ts-1');
+        // Session created with the LAST USED combo.
+        const createCall = fetchImpl.mock.calls.find((c) => c[1]?.method === 'POST' && String(c[0]).endsWith('/api/sessions'));
+        expect(JSON.parse(createCall[1].body)).toMatchObject({
+            title: 'Remote Setup Troubleshooting',
+            runtime_type: 'repoburg',
+            model: 'glm',
+            cwd: '/repo',
+        });
+        // The prompt carries the playbook but never the tunnel token.
+        const turnCall = fetchImpl.mock.calls.find((c) => String(c[0]).includes('/api/sessions/ts-1/turns'));
+        const prompt = JSON.parse(turnCall[1].body).user_prompt;
+        expect(prompt).toContain('localhost:9998/remote/status');
+        expect(prompt).not.toContain('TUNNELSECRET');
+    });
+    it('fails (no agent) when the pane has no sessions', async () => {
+        const fetchImpl = jest.fn(async () => ({ ok: true, json: async () => [] }));
+        const deps = makeDeps({ fetchImpl: fetchImpl });
+        const job = makeJob();
+        await (0, orchestrator_1.runEnable)(job, deps);
+        expect(job.state).toBe('failed');
+        expect(job.troubleshootingSessionId).toBeNull();
+        expect(job.error).toContain('no agent sessions');
+    });
+    it('getEnableJob returns null before any job', () => {
+        expect((0, orchestrator_1.getEnableJob)()).toBeNull();
+    });
+});

package/daemon/dist/remote/probes.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probePublicHealth = probePublicHealth;
+exports.probeTunnelConnected = probeTunnelConnected;
+/**
+ * Connectivity probes shared by the /remote routes and the enable
+ * orchestrator. Both signals are needed: the public health probe only proves
+ * the edge knows the hostname (CF Access answers 302 before the tunnel is
+ * consulted), while the cloudflared metrics gauge proves live edge
+ * connections through the tunnel.
+ */
+const tunnel_state_1 = require("./tunnel-state");
+const cloudflared_1 = require("./cloudflared");
+const HEALTH_CHECK_TIMEOUT_MS = 10000;
+function publicHealthUrl() {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    return state ? `https://${state.hostname}/health` : null;
+}
+/**
+ * Edge reachability probe. Behind CF Access an anonymous request gets a 302
+ * to the login page BEFORE the tunnel is ever consulted — so this can only
+ * prove the edge knows the hostname, never that the tunnel is connected.
+ * `redirect: 'manual'` prevents the old false positive where the login
+ * page's 200 was counted as a healthy daemon.
+ */
+async function probePublicHealth(timeoutMs = HEALTH_CHECK_TIMEOUT_MS) {
+    const url = publicHealthUrl();
+    if (!url)
+        return false;
+    try {
+        const response = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(timeoutMs) });
+        return response.status >= 200 && response.status < 400;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Tunnel connectivity from cloudflared's LOCAL metrics endpoint. This is the
+ * primary "is the tunnel actually serving" signal: `ha_connections` counts
+ * live edge connections (0 or unreachable metrics = not connected).
+ */
+async function probeTunnelConnected(timeoutMs = HEALTH_CHECK_TIMEOUT_MS) {
+    try {
+        const response = await fetch((0, cloudflared_1.cloudflaredMetricsUrl)(), {
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!response.ok)
+            return false;
+        const body = await response.text();
+        // The gauge may appear label-less (`… 4`) or labeled (`…{region="us"} 4`);
+        // ^… anchors past the HELP/TYPE lines.
+        const match = body.match(/^cloudflared_tunnel_ha_connections(?:\{[^}]*\})?\s+([0-9.]+)/m);
+        return Boolean(match && Number(match[1]) > 0);
+    }
+    catch {
+        return false;
+    }
+}

package/daemon/dist/remote/provisioner.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
+exports.accountServerUrl = accountServerUrl;
+exports.provisionTunnel = provisionTunnel;
+exports.listTunnels = listTunnels;
+exports.uninstallTunnel = uninstallTunnel;
+/**
+ * Account-server client for tunnel lifecycle. The daemon authenticates with
+ * the device JWT from `repoburg login` (~/.repoburg/token.jwt).
+ */
+const authManager_1 = require("../auth/authManager");
+const tunnel_state_1 = require("./tunnel-state");
+const isDevelopment = process.env.NODE_ENV === 'development';
+const DEFAULT_ACCOUNT_SERVER_URL = isDevelopment
+    ? 'http://localhost:2999'
+    : 'https://repoburg.com/api/account';
+function accountServerUrl() {
+    return process.env.ACCOUNT_SERVER_URL ?? DEFAULT_ACCOUNT_SERVER_URL;
+}
+class ProvisioningError extends Error {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+exports.ProvisioningError = ProvisioningError;
+async function callAccountServer(method, path, token, body) {
+    const response = await fetch(`${accountServerUrl()}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const data = (await response.json().catch(() => ({})));
+    if (!response.ok) {
+        const message = data.message ?? data.error ?? response.statusText;
+        throw new ProvisioningError(`Account server: ${message}`, response.status);
+    }
+    return data;
+}
+/**
+ * Provision a new tunnel for this machine and persist the state locally.
+ * The response's tunnel_token is the only credential written to disk.
+ */
+async function provisionTunnel(mahlas) {
+    const token = await authManager_1.authManager.readToken();
+    if (!token) {
+        throw new ProvisioningError('Not logged in. Run `repoburg login` first.', 401);
+    }
+    const result = await callAccountServer('POST', '/device/tunnels', token, { mahlas });
+    // Access config + owner email arrive in the same response: the tunnel is
+    // email-gated from birth, and checkRemoteAuth can pin the owner's email.
+    const state = {
+        mahlas: result.mahlas,
+        hostname: result.hostname,
+        accountTunnelId: result.id,
+        tunnelToken: result.tunnel_token,
+        accessTeamDomain: result.accessTeamDomain,
+        accessAud: result.accessAud,
+        ownerEmail: result.ownerEmail,
+        installedAt: new Date().toISOString(),
+    };
+    (0, tunnel_state_1.saveTunnelState)(state);
+    return state;
+}
+/** List this user's machines (used by the pane machine list when local). */
+async function listTunnels() {
+    const token = await authManager_1.authManager.readToken();
+    if (!token)
+        return [];
+    return callAccountServer('GET', '/device/tunnels', token);
+}
+/** Remove the tunnel on the account server and wipe the local state. */
+async function uninstallTunnel() {
+    const state = (0, tunnel_state_1.loadTunnelState)();
+    if (!state)
+        return;
+    const token = await authManager_1.authManager.readToken();
+    if (token) {
+        await callAccountServer('DELETE', `/device/tunnels/${state.accountTunnelId}`, token);
+    }
+    (0, tunnel_state_1.clearTunnelState)();
+}