repoburg 1.3.217 → 1.3.219

package/daemon/dist/remote/provisioner.spec.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const provisioner_1 = require("./provisioner");
+const tunnel_state_1 = require("./tunnel-state");
+const authManager_1 = require("../auth/authManager");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmpHome = fs_extra_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'provisioner-'));
+process.env.ACCOUNT_SERVER_URL = 'http://account-server.test';
+jest.mock('../auth/authManager', () => ({
+    authManager: { readToken: jest.fn() },
+}));
+const mockedReadToken = authManager_1.authManager.readToken;
+afterEach(() => {
+    (0, tunnel_state_1.clearTunnelState)(tmpHome);
+    mockedReadToken.mockReset();
+});
+describe('provisioner', () => {
+    it('provisions a tunnel and persists only the machine-local state', async () => {
+        mockedReadToken.mockResolvedValue('device-jwt');
+        const fetchMock = jest.fn(async () => ({
+            ok: true,
+            status: 200,
+            json: async () => ({
+                id: 'tunnel-uuid',
+                mahlas: 'workstation',
+                hostname: 'workstation.repoburg.com',
+                tunnel_token: 'connector-token',
+                accessTeamDomain: 'team.cloudflareaccess.com',
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            }),
+        }));
+        global.fetch = fetchMock;
+        const origHomedir = os_1.default.homedir;
+        os_1.default.homedir = () => tmpHome;
+        try {
+            const state = await (0, provisioner_1.provisionTunnel)('workstation');
+            expect(state).toMatchObject({
+                mahlas: 'workstation',
+                hostname: 'workstation.repoburg.com',
+                accountTunnelId: 'tunnel-uuid',
+                tunnelToken: 'connector-token',
+                accessTeamDomain: 'team.cloudflareaccess.com',
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            });
+            expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toMatchObject({
+                accountTunnelId: 'tunnel-uuid',
+                // The Access config arrives with the tunnel — email-gated from birth.
+                accessAud: 'aud-tag',
+                ownerEmail: 'owner@repoburg.com',
+            });
+            const [url, init] = fetchMock.mock.calls[0];
+            expect(url).toBe('http://account-server.test/device/tunnels');
+            expect(init.headers.Authorization).toBe('Bearer device-jwt');
+        }
+        finally {
+            os_1.default.homedir = origHomedir;
+        }
+    });
+    it('refuses to provision when not logged in', async () => {
+        mockedReadToken.mockResolvedValue(null);
+        await expect((0, provisioner_1.provisionTunnel)('workstation')).rejects.toBeInstanceOf(provisioner_1.ProvisioningError);
+    });
+    it('surfaces account-server errors', async () => {
+        mockedReadToken.mockResolvedValue('device-jwt');
+        global.fetch = jest.fn(async () => ({
+            ok: false,
+            status: 409,
+            json: async () => ({ message: 'Mahlas already taken' }),
+        }));
+        await expect((0, provisioner_1.provisionTunnel)('workstation')).rejects.toThrow(/already taken/);
+    });
+    it('uninstalls the tunnel on the server and clears local state', async () => {
+        (0, tunnel_state_1.saveTunnelState)({
+            mahlas: 'workstation',
+            hostname: 'workstation.repoburg.com',
+            accountTunnelId: 'tunnel-uuid',
+            tunnelToken: 'connector-token',
+        }, tmpHome);
+        mockedReadToken.mockResolvedValue('device-jwt');
+        const fetchMock = jest.fn(async () => ({ ok: true, status: 200, json: async () => ({}) }));
+        global.fetch = fetchMock;
+        const origHomedir = os_1.default.homedir;
+        os_1.default.homedir = () => tmpHome;
+        try {
+            await (0, provisioner_1.uninstallTunnel)();
+            expect(fetchMock.mock.calls[0][0]).toBe('http://account-server.test/device/tunnels/tunnel-uuid');
+            expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toBeNull();
+        }
+        finally {
+            os_1.default.homedir = origHomedir;
+        }
+    });
+    it('lists tunnels only when logged in', async () => {
+        mockedReadToken.mockResolvedValue(null);
+        await expect((0, provisioner_1.listTunnels)()).resolves.toEqual([]);
+    });
+});

package/daemon/dist/remote/routes.js

@@ -0,0 +1,155 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRemoteRouter = createRemoteRouter;
+const express_1 = require("express");
+const tunnel_state_1 = require("./tunnel-state");
+const provisioner_1 = require("./provisioner");
+const probes_1 = require("./probes");
+const orchestrator_1 = require("./orchestrator");
+const cloudflared_1 = require("./cloudflared");
+const os_1 = __importDefault(require("os"));
+/**
+ * Local-only tunnel lifecycle API.
+ *
+ * SECURITY: this router must NEVER be reachable through the tunnel. The
+ * account-server blocks `^/remote(/.*)?$` at the CF ingress edge (404), and
+ * these endpoints manage the machine itself.
+ */
+function errorResponse(res, error) {
+    // Account-server errors carry a meaningful HTTP status (ProvisioningError).
+    const statusCode = error.statusCode;
+    const message = error.message ?? 'Unknown error';
+    if (typeof statusCode === 'number' && statusCode >= 400 && statusCode < 600) {
+        res.status(statusCode).json({ error: message });
+        return;
+    }
+    res.status(500).json({ error: message });
+}
+function createRemoteRouter() {
+    const router = (0, express_1.Router)();
+    // Full status snapshot for the skill's first diagnostic step.
+    router.get('/status', async (_req, res) => {
+        const state = (0, tunnel_state_1.loadTunnelState)();
+        const platformSupported = ['linux', 'darwin'].includes(os_1.default.platform());
+        res.json({
+            daemonRunning: true,
+            platform: os_1.default.platform(),
+            platformSupported,
+            tunnel: state
+                ? { mahlas: state.mahlas, hostname: state.hostname, provisioned: true }
+                : { provisioned: false },
+            cloudflared: { installed: (0, cloudflared_1.isInstalled)() },
+            service: { running: await (0, cloudflared_1.isServiceRunning)().catch(() => false) },
+            connection: { ok: await (0, probes_1.probeTunnelConnected)() },
+            access: {
+                configured: Boolean(state?.accessTeamDomain && state?.accessAud),
+                ownerEmail: state?.ownerEmail ?? null,
+                teamDomain: state?.accessTeamDomain ?? null,
+            },
+            publicHealth: { ok: await (0, probes_1.probePublicHealth)() },
+        });
+    });
+    // Create the tunnel on the account server; state saved, nothing installed yet.
+    router.post('/provision', async (req, res) => {
+        const mahlas = req.body?.mahlas;
+        if (typeof mahlas !== 'string' || mahlas.length === 0) {
+            res.status(400).json({ error: 'Body must include { "mahlas": "..." }' });
+            return;
+        }
+        try {
+            const state = await (0, provisioner_1.provisionTunnel)(mahlas);
+            res.json({
+                mahlas: state.mahlas,
+                hostname: state.hostname,
+                message: 'Tunnel provisioned. Next: POST /remote/install.',
+            });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Download cloudflared + install + start the system service.
+    router.post('/install', async (_req, res) => {
+        const state = (0, tunnel_state_1.loadTunnelState)();
+        if (!state) {
+            res.status(409).json({ error: 'No tunnel provisioned. Call POST /remote/provision first.' });
+            return;
+        }
+        try {
+            if (!(0, cloudflared_1.isInstalled)()) {
+                await (0, cloudflared_1.downloadCloudflared)();
+            }
+            const servicePath = await (0, cloudflared_1.installService)(state.tunnelToken);
+            const running = await (0, cloudflared_1.isServiceRunning)();
+            // Primary verification: live edge connections from cloudflared metrics.
+            // The edge probe alone is meaningless behind CF Access (always 302).
+            const connected = await (0, probes_1.probeTunnelConnected)();
+            res.json({
+                installed: true,
+                servicePath,
+                running,
+                connection: { ok: connected },
+                message: connected
+                    ? `Machine is reachable at https://${state.hostname}`
+                    : 'Service started but the tunnel has no live connections — check service logs.',
+            });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Stop the tunnel service but keep the provisioned tunnel.
+    router.post('/disable', async (_req, res) => {
+        try {
+            await (0, cloudflared_1.removeService)();
+            res.json({ disabled: true });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Remove service + tunnel (account server) + local state.
+    router.delete('/uninstall', async (_req, res) => {
+        try {
+            await (0, cloudflared_1.removeService)();
+            await (0, provisioner_1.uninstallTunnel)();
+            (0, tunnel_state_1.clearTunnelState)();
+            res.json({ uninstalled: true });
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    // Deterministic enable orchestration — the daemon runs provision/install/
+    // verify itself; the UI only polls GET /remote/enable.
+    const MAHLAS_RE = /^[a-z][a-z0-9-]{1,30}$/;
+    router.post('/enable', (req, res) => {
+        const mahlas = req.body?.mahlas;
+        if (typeof mahlas !== 'string' || !MAHLAS_RE.test(mahlas)) {
+            res.status(400).json({ error: 'Body must include { "mahlas": "..." } (a-z, 0-9, "-").' });
+            return;
+        }
+        try {
+            res.json((0, orchestrator_1.startEnableJob)(mahlas));
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    router.get('/enable', (_req, res) => {
+        res.json((0, orchestrator_1.getEnableJob)());
+    });
+    // Machine list from the account server (for the pane machine switcher).
+    router.get('/machines', async (_req, res) => {
+        try {
+            res.json(await (0, provisioner_1.listTunnels)());
+        }
+        catch (error) {
+            errorResponse(res, error);
+        }
+    });
+    return router;
+}

package/daemon/dist/remote/routes.spec.js

@@ -0,0 +1,245 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = __importDefault(require("http"));
+const express_1 = __importDefault(require("express"));
+const routes_1 = require("./routes");
+jest.mock('./tunnel-state');
+jest.mock('./provisioner');
+jest.mock('./cloudflared');
+jest.mock('./orchestrator');
+const tunnel_state_1 = require("./tunnel-state");
+const provisioner_1 = require("./provisioner");
+const orchestrator_1 = require("./orchestrator");
+const cloudflared_1 = require("./cloudflared");
+const mocked = {
+    loadTunnelState: tunnel_state_1.loadTunnelState,
+    updateTunnelState: tunnel_state_1.updateTunnelState,
+    clearTunnelState: tunnel_state_1.clearTunnelState,
+    provisionTunnel: provisioner_1.provisionTunnel,
+    uninstallTunnel: provisioner_1.uninstallTunnel,
+    listTunnels: provisioner_1.listTunnels,
+    isInstalled: cloudflared_1.isInstalled,
+    downloadCloudflared: cloudflared_1.downloadCloudflared,
+    installService: cloudflared_1.installService,
+    removeService: cloudflared_1.removeService,
+    isServiceRunning: cloudflared_1.isServiceRunning,
+    cloudflaredMetricsUrl: cloudflared_1.cloudflaredMetricsUrl,
+};
+const METRICS_URL = 'http://127.0.0.1:20241/metrics';
+/** Real cloudflared exports the gauge label-less — HELP/TYPE lines included. */
+const METRICS_BODY_CONNECTED = '# HELP cloudflared_tunnel_ha_connections Number of active ha connections\n' +
+    '# TYPE cloudflared_tunnel_ha_connections gauge\n' +
+    'cloudflared_tunnel_ha_connections 4\n';
+/** fetch mock: metrics endpoint answers connected by default, health 200. */
+function makeFetch(opts = {}) {
+    return jest.fn(async (url) => {
+        const href = String(url);
+        if (href === METRICS_URL) {
+            return {
+                ok: true,
+                status: 200,
+                text: async () => opts.metricsBody ?? METRICS_BODY_CONNECTED,
+            };
+        }
+        return {
+            ok: opts.healthOk ?? true,
+            status: (opts.healthOk ?? true) ? 200 : 530,
+        };
+    });
+}
+const STATE = {
+    mahlas: 'workstation',
+    hostname: 'workstation.repoburg.com',
+    accountTunnelId: 'tunnel-uuid',
+    tunnelToken: 'connector-token',
+};
+function request(server, method, path, body) {
+    const { port } = server.address();
+    return new Promise((resolve, reject) => {
+        const payload = body === undefined ? undefined : JSON.stringify(body);
+        const req = http_1.default.request({
+            host: '127.0.0.1',
+            port,
+            method,
+            path,
+            headers: payload ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) } : undefined,
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => (data += chunk));
+            // Non-JSON replies (e.g. express 404 HTML) are status-only checks.
+            res.on('end', () => {
+                let json = null;
+                try {
+                    json = JSON.parse(data || '{}');
+                }
+                catch {
+                    json = null;
+                }
+                resolve({ status: res.statusCode ?? 0, json });
+            });
+        });
+        req.on('error', reject);
+        if (payload)
+            req.write(payload);
+        req.end();
+    });
+}
+describe('remote routes', () => {
+    let server;
+    beforeEach(async () => {
+        for (const mock of Object.values(mocked))
+            mock.mockReset();
+        mocked.cloudflaredMetricsUrl.mockReturnValue(METRICS_URL);
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use('/remote', (0, routes_1.createRemoteRouter)());
+        server = (await new Promise((resolve) => {
+            const s = app.listen(0, '127.0.0.1', () => resolve(s));
+        }));
+    });
+    afterEach(() => new Promise((resolve) => server.close(() => resolve())));
+    it('GET /status aggregates tunnel, cloudflared, service, connection, and access', async () => {
+        mocked.loadTunnelState.mockReturnValue({
+            ...STATE,
+            accessTeamDomain: 'team.cloudflareaccess.com',
+            accessAud: 'aud-tag',
+            ownerEmail: 'owner@repoburg.com',
+        });
+        mocked.isInstalled.mockReturnValue(true);
+        mocked.isServiceRunning.mockResolvedValue(true);
+        global.fetch = makeFetch();
+        const res = await request(server, 'GET', '/remote/status');
+        expect(res.status).toBe(200);
+        expect(res.json.tunnel).toEqual({ mahlas: 'workstation', hostname: 'workstation.repoburg.com', provisioned: true });
+        expect(res.json.cloudflared).toEqual({ installed: true });
+        expect(res.json.service).toEqual({ running: true });
+        expect(res.json.connection).toEqual({ ok: true });
+        expect(res.json.access).toEqual({
+            configured: true,
+            ownerEmail: 'owner@repoburg.com',
+            teamDomain: 'team.cloudflareaccess.com',
+        });
+        expect(res.json.publicHealth).toEqual({ ok: true });
+    });
+    it('GET /status reports connection false when cloudflared metrics show 0 ha connections', async () => {
+        mocked.loadTunnelState.mockReturnValue(STATE);
+        mocked.isServiceRunning.mockResolvedValue(false);
+        global.fetch = makeFetch({ metricsBody: 'cloudflared_tunnel_ha_connections 0\n' });
+        const res = await request(server, 'GET', '/remote/status');
+        expect(res.json.connection).toEqual({ ok: false });
+    });
+    it('GET /status accepts labeled metric lines too (other cloudflared versions)', async () => {
+        mocked.loadTunnelState.mockReturnValue(STATE);
+        mocked.isServiceRunning.mockResolvedValue(true);
+        global.fetch = makeFetch({ metricsBody: 'cloudflared_tunnel_ha_connections{region="us"} 2\n' });
+        const res = await request(server, 'GET', '/remote/status');
+        expect(res.json.connection).toEqual({ ok: true });
+    });
+    it('GET /status reports connection false when metrics are unreachable', async () => {
+        mocked.loadTunnelState.mockReturnValue(STATE);
+        mocked.isServiceRunning.mockResolvedValue(false);
+        global.fetch = jest.fn().mockRejectedValue(new Error('ECONNREFUSED'));
+        const res = await request(server, 'GET', '/remote/status');
+        expect(res.json.connection).toEqual({ ok: false });
+        expect(res.json.publicHealth).toEqual({ ok: false });
+    });
+    it('GET /status reports false health when no tunnel exists', async () => {
+        mocked.loadTunnelState.mockReturnValue(null);
+        mocked.isInstalled.mockReturnValue(false);
+        mocked.isServiceRunning.mockResolvedValue(false);
+        const res = await request(server, 'GET', '/remote/status');
+        expect(res.json.tunnel).toEqual({ provisioned: false });
+        expect(res.json.publicHealth).toEqual({ ok: false });
+        expect(res.json.connection).toEqual({ ok: false });
+    });
+    it('POST /provision validates the mahlas body', async () => {
+        const res = await request(server, 'POST', '/remote/provision', {});
+        expect(res.status).toBe(400);
+        expect(mocked.provisionTunnel).not.toHaveBeenCalled();
+    });
+    it('POST /provision provisions and reports the hostname', async () => {
+        mocked.provisionTunnel.mockResolvedValue(STATE);
+        const res = await request(server, 'POST', '/remote/provision', { mahlas: 'workstation' });
+        expect(res.status).toBe(200);
+        expect(res.json.hostname).toBe('workstation.repoburg.com');
+        expect(mocked.provisionTunnel).toHaveBeenCalledWith('workstation');
+    });
+    it('POST /provision maps ProvisioningError status codes', async () => {
+        const err = new Error('taken');
+        err.statusCode = 409;
+        mocked.provisionTunnel.mockRejectedValue(err);
+        const res = await request(server, 'POST', '/remote/provision', { mahlas: 'x' });
+        expect(res.status).toBe(409);
+    });
+    it('POST /install requires a provisioned tunnel', async () => {
+        mocked.loadTunnelState.mockReturnValue(null);
+        const res = await request(server, 'POST', '/remote/install');
+        expect(res.status).toBe(409);
+    });
+    it('POST /install downloads (when missing), writes the service, and probes metrics connectivity', async () => {
+        mocked.loadTunnelState.mockReturnValue(STATE);
+        mocked.isInstalled.mockReturnValue(false);
+        mocked.downloadCloudflared.mockResolvedValue('/bin/cloudflared');
+        mocked.installService.mockResolvedValue('/unit/path');
+        mocked.isServiceRunning.mockResolvedValue(true);
+        global.fetch = makeFetch();
+        const res = await request(server, 'POST', '/remote/install');
+        expect(res.status).toBe(200);
+        expect(mocked.downloadCloudflared).toHaveBeenCalled();
+        expect(mocked.installService).toHaveBeenCalledWith('connector-token');
+        expect(res.json.connection).toEqual({ ok: true });
+        expect(res.json.message).toContain('https://workstation.repoburg.com');
+    });
+    it('POST /install skips the download when cloudflared is present', async () => {
+        mocked.loadTunnelState.mockReturnValue(STATE);
+        mocked.isInstalled.mockReturnValue(true);
+        mocked.installService.mockResolvedValue('/unit/path');
+        mocked.isServiceRunning.mockResolvedValue(true);
+        global.fetch = makeFetch({ metricsBody: 'cloudflared_tunnel_ha_connections{region="us"} 0\n' });
+        const res = await request(server, 'POST', '/remote/install');
+        expect(mocked.downloadCloudflared).not.toHaveBeenCalled();
+        expect(res.json.connection).toEqual({ ok: false });
+        expect(res.json.message).toContain('no live connections');
+    });
+    it('POST /access-config no longer exists (Access is provisioned automatically)', async () => {
+        const res = await request(server, 'POST', '/remote/access-config', { teamDomain: 't', aud: 'a' });
+        expect(res.status).toBe(404);
+        expect(mocked.updateTunnelState).not.toHaveBeenCalled();
+    });
+    it('DELETE /uninstall removes service, server tunnel, and local state', async () => {
+        mocked.removeService.mockResolvedValue(undefined);
+        mocked.uninstallTunnel.mockResolvedValue(undefined);
+        const res = await request(server, 'DELETE', '/remote/uninstall');
+        expect(res.status).toBe(200);
+        expect(mocked.removeService).toHaveBeenCalled();
+        expect(mocked.uninstallTunnel).toHaveBeenCalled();
+        expect(mocked.clearTunnelState).toHaveBeenCalled();
+    });
+    it('POST /enable validates the mahlas and starts the orchestration job', async () => {
+        orchestrator_1.startEnableJob.mockReturnValue({ id: 'job-1', state: 'running' });
+        const res = await request(server, 'POST', '/remote/enable', { mahlas: 'my-box' });
+        expect(res.status).toBe(200);
+        expect(res.json.id).toBe('job-1');
+        expect(orchestrator_1.startEnableJob).toHaveBeenCalledWith('my-box');
+    });
+    it('POST /enable rejects an invalid mahlas', async () => {
+        orchestrator_1.startEnableJob.mockClear();
+        const res = await request(server, 'POST', '/remote/enable', { mahlas: 'BAD NAME' });
+        expect(res.status).toBe(400);
+        expect(orchestrator_1.startEnableJob).not.toHaveBeenCalled();
+    });
+    it('GET /enable returns the current (or last) job', async () => {
+        orchestrator_1.getEnableJob.mockReturnValue({ id: 'job-9', state: 'ready' });
+        const res = await request(server, 'GET', '/remote/enable');
+        expect(res.status).toBe(200);
+        expect(res.json.id).toBe('job-9');
+    });
+    it('GET /machines lists the account-server machines', async () => {
+        mocked.listTunnels.mockResolvedValue([{ id: '1', mahlas: 'workstation', hostname: 'workstation.repoburg.com', status: 'active' }]);
+        const res = await request(server, 'GET', '/remote/machines');
+        expect(res.json).toHaveLength(1);
+    });
+});

package/daemon/dist/remote/tunnel-state.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.remoteStatePath = remoteStatePath;
+exports.loadTunnelState = loadTunnelState;
+exports.saveTunnelState = saveTunnelState;
+exports.updateTunnelState = updateTunnelState;
+exports.clearTunnelState = clearTunnelState;
+/**
+ * Tunnel state persisted on the machine (~/.repoburg/remote.json).
+ *
+ * The tunnel token stored here is BY DESIGN machine-local: it is the
+ * single-purpose Cloudflare connector token that can only run this one
+ * tunnel — it cannot create, read, or delete tunnels, DNS, or anything else.
+ */
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+function remoteStatePath(home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.repoburg', 'remote.json');
+}
+function loadTunnelState(home = os_1.default.homedir()) {
+    const statePath = remoteStatePath(home);
+    if (!fs_extra_1.default.existsSync(statePath))
+        return null;
+    try {
+        const state = fs_extra_1.default.readJsonSync(statePath);
+        if (!state.hostname || !state.tunnelToken || !state.accountTunnelId)
+            return null;
+        return state;
+    }
+    catch {
+        return null;
+    }
+}
+function saveTunnelState(state, home = os_1.default.homedir()) {
+    const statePath = remoteStatePath(home);
+    fs_extra_1.default.ensureDirSync(path_1.default.dirname(statePath));
+    fs_extra_1.default.writeJsonSync(statePath, state, { spaces: 2 });
+}
+function updateTunnelState(patch, home = os_1.default.homedir()) {
+    const current = loadTunnelState(home);
+    if (!current)
+        return null;
+    const next = { ...current, ...patch };
+    saveTunnelState(next, home);
+    return next;
+}
+function clearTunnelState(home = os_1.default.homedir()) {
+    const statePath = remoteStatePath(home);
+    fs_extra_1.default.removeSync(statePath);
+}

package/daemon/dist/remote/tunnel-state.spec.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const tunnel_state_1 = require("./tunnel-state");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmpHome = fs_extra_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'remote-state-'));
+afterEach(() => (0, tunnel_state_1.clearTunnelState)(tmpHome));
+describe('tunnel state', () => {
+    const state = {
+        mahlas: 'workstation',
+        hostname: 'workstation.repoburg.com',
+        accountTunnelId: 'tunnel-uuid',
+        tunnelToken: 'connector-token',
+        accessTeamDomain: 'team.cloudflareaccess.com',
+        accessAud: 'aud-tag',
+        ownerEmail: 'owner@repoburg.com',
+    };
+    it('round-trips the state to ~/.repoburg/remote.json', () => {
+        (0, tunnel_state_1.saveTunnelState)(state, tmpHome);
+        expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toEqual(state);
+        expect(fs_extra_1.default.existsSync((0, tunnel_state_1.remoteStatePath)(tmpHome))).toBe(true);
+    });
+    it('returns null when no state exists', () => {
+        expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toBeNull();
+    });
+    it('returns null for malformed or incomplete state files', () => {
+        (0, tunnel_state_1.saveTunnelState)(state, tmpHome);
+        fs_extra_1.default.writeJsonSync((0, tunnel_state_1.remoteStatePath)(tmpHome), { hostname: 'x.repoburg.com' }); // missing fields
+        expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toBeNull();
+    });
+    it('clears the state file', () => {
+        (0, tunnel_state_1.saveTunnelState)(state, tmpHome);
+        (0, tunnel_state_1.clearTunnelState)(tmpHome);
+        expect((0, tunnel_state_1.loadTunnelState)(tmpHome)).toBeNull();
+    });
+});

package/daemon/dist/staticServing.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePaneFrontendDist = resolvePaneFrontendDist;
+exports.createPaneFrontendRouter = createPaneFrontendRouter;
+/**
+ * Static serving for the pane frontend SPA.
+ *
+ * Spec: a machine's daemon serves the pane at https://<mahlas>.repoburg.com
+ * from its own origin — SPA and API share one origin (no CORS, no
+ * mixed-content). The router is mounted LAST: every API path (/api, /ws,
+ * /services, /auth, /registry, /mcp, /remote) is matched by earlier
+ * routers and never reaches the fallback.
+ *
+ * Path resolution is ABSOLUTE (pm2 God-daemon-cwd bug — see agentPane.ts).
+ */
+const express_1 = __importDefault(require("express"));
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+/** Resolve the pane frontend dist from the daemon's module directory. */
+function resolvePaneFrontendDist(fromDir) {
+    return path_1.default.resolve(fromDir, '../../agent-pane/frontend/dist');
+}
+/**
+ * Build the static router: assets from dist, SPA fallback to index.html for
+ * client-side routes. Returns null when the dist bundle is missing (dev
+ * installs serve the frontend via vite instead).
+ */
+function createPaneFrontendRouter(distPath) {
+    const indexHtml = path_1.default.join(distPath, 'index.html');
+    if (!fs_extra_1.default.existsSync(indexHtml)) {
+        return null;
+    }
+    const router = express_1.default.Router();
+    // Static assets with fallthrough so the SPA fallback handles routes.
+    router.use(express_1.default.static(distPath, { fallthrough: true }));
+    // SPA fallback: any GET that no earlier route handled becomes the app.
+    router.get('*', (_req, res) => {
+        res.sendFile(indexHtml);
+    });
+    return router;
+}