sakuraai 0.0.14 → 0.0.16

package/dist/index.js

@@ -4651,6 +4651,7 @@ var init_server = __esm({
 });
 
 // src/daemon/tsnet.ts
+import crypto from "crypto";
 import fs21 from "fs";
 import path19 from "path";
 import { fileURLToPath } from "url";
@@ -4678,35 +4679,63 @@ function startTsnet(port2) {
   const bin = resolveBinary();
   if (!bin) {
     log.warn(
-      "embedded Tailscale is configured but the sakura-tsnet binary was not found \u2014 build it with modules/sakura-tailscale/scripts/build-sidecar.sh (LAN access still works)."
+      "embedded Tailscale is configured but the sakura-tsnet binary was not found \u2014 reinstall with `npm i -g sakuraai@latest --foreground-scripts` (LAN access still works)."
     );
     return;
   }
   stopping = false;
-  spawnSidecar(bin, ts.controlUrl, ts.authKey, ts.hostname || cfg.machineName, port2);
+  resetStateIfKeyChanged(ts.authKey);
+  const fresh = !fs21.existsSync(path19.join(STATE_DIR, "tailscaled.state")) && !fs21.existsSync(JOINED_MARK);
+  spawnSidecar(bin, ts.controlUrl, ts.authKey, ts.hostname || cfg.machineName, port2, fresh);
 }
-function spawnSidecar(bin, controlUrl, authKey, hostname2, port2) {
+function resetStateIfKeyChanged(authKey) {
+  const hash = crypto.createHash("sha256").update(authKey).digest("hex");
+  let prev = null;
+  try {
+    prev = fs21.readFileSync(KEY_MARK, "utf8").trim();
+  } catch {
+  }
+  if (prev && prev !== hash) {
+    log.info("tailnet key changed \u2014 re-registering this Mac on the new key");
+    fs21.rmSync(STATE_DIR, { recursive: true, force: true });
+  }
+  fs21.mkdirSync(STATE_DIR, { recursive: true });
+  fs21.writeFileSync(KEY_MARK, hash);
+}
+function spawnSidecar(bin, controlUrl, authKey, hostname2, port2, forceLogin) {
   const env = {
     ...process.env,
     SAKURA_TS_CONTROL_URL: controlUrl,
     SAKURA_TS_AUTH_KEY: authKey,
     SAKURA_TS_HOSTNAME: hostname2,
-    SAKURA_TS_STATE_DIR: path19.join(SAKURA_DIR, "tsnet-state"),
+    SAKURA_TS_STATE_DIR: STATE_DIR,
     SAKURA_TS_STATE_FILE: TSNET_PATH,
     SAKURA_TS_PORT: String(port2)
   };
-  log.info(`starting embedded Tailscale sidecar (${path19.basename(bin)})`);
+  if (forceLogin) env.TSNET_FORCE_LOGIN = "1";
+  log.info(`starting embedded Tailscale sidecar (${path19.basename(bin)})${forceLogin ? " with a forced login" : ""}`);
   const c = spawn11(bin, [], { stdio: ["ignore", "pipe", "pipe"], env });
   child = c;
-  const pipe = (buf) => buf.toString().split("\n").filter(Boolean).forEach((line) => log.info(`[tsnet] ${line}`));
+  let joinFailed = false;
+  const pipe = (buf) => buf.toString().split("\n").filter(Boolean).forEach((line) => {
+    log.info(`[tsnet] ${line}`);
+    if (line.includes("failed to join tailnet")) joinFailed = true;
+    if (line.includes("on tailnet as")) {
+      try {
+        fs21.writeFileSync(JOINED_MARK, (/* @__PURE__ */ new Date()).toISOString());
+      } catch {
+      }
+    }
+  });
   c.stdout?.on("data", pipe);
   c.stderr?.on("data", pipe);
   c.on("exit", (code) => {
     child = null;
     if (stopping) return;
+    const force = forceLogin || joinFailed && !fs21.existsSync(JOINED_MARK);
     log.warn(`tsnet sidecar exited (code ${code}); restarting in 5s`);
     restartTimer = setTimeout(() => {
-      if (!stopping) spawnSidecar(bin, controlUrl, authKey, hostname2, port2);
+      if (!stopping) spawnSidecar(bin, controlUrl, authKey, hostname2, port2, force);
     }, 5e3);
   });
 }
@@ -4728,7 +4757,7 @@ function stopTsnet() {
   } catch {
   }
 }
-var child, stopping, restartTimer;
+var child, stopping, restartTimer, STATE_DIR, KEY_MARK, JOINED_MARK;
 var init_tsnet = __esm({
   "src/daemon/tsnet.ts"() {
     "use strict";
@@ -4737,6 +4766,9 @@ var init_tsnet = __esm({
     child = null;
     stopping = false;
     restartTimer = null;
+    STATE_DIR = path19.join(SAKURA_DIR, "tsnet-state");
+    KEY_MARK = path19.join(STATE_DIR, "joined-with");
+    JOINED_MARK = path19.join(STATE_DIR, "joined");
   }
 });
 
@@ -4885,27 +4917,80 @@ var init_manager = __esm({
 // src/pairing.ts
 import os10 from "os";
 import qrcode from "qrcode-terminal";
+import fs23 from "fs";
+function recentTsnetLog(max = 6) {
+  let text = "";
+  try {
+    const fd = fs23.openSync(LOG_PATH, "r");
+    const size = fs23.fstatSync(fd).size;
+    const len = Math.min(size, 64 * 1024);
+    const buf = Buffer.alloc(len);
+    fs23.readSync(fd, buf, 0, len, size - len);
+    fs23.closeSync(fd);
+    text = buf.toString("utf8");
+  } catch {
+    return [];
+  }
+  const lines2 = text.split("\n").filter((l) => /tsnet|sidecar|tailnet/i.test(l));
+  const distinct = lines2.filter((l, i) => l !== lines2[i - 1]);
+  return distinct.slice(-max);
+}
+function diagnoseTailnet(tsnet) {
+  if (!resolveBinary()) {
+    return {
+      reason: "the sakura-tsnet binary is missing. It is downloaded when sakuraai installs, and that download failed or was skipped (bun/pnpm, or --ignore-scripts).",
+      fix: "npm i -g sakuraai@latest --foreground-scripts && sakuraai daemon restart",
+      log: []
+    };
+  }
+  if (!tsnet) {
+    return {
+      reason: "the tailnet sidecar has not reported in. It may still be starting, or it failed to start.",
+      fix: "sakuraai daemon restart, wait ~15s, then run sakuraai pair again",
+      log: recentTsnetLog()
+    };
+  }
+  return {
+    reason: `the tailnet sidecar is stuck in state "${tsnet.backendState}" instead of Running.`,
+    fix: "sakuraai daemon restart, wait ~15s, then run sakuraai pair again. If it stays stuck, sakuraai logout && sakuraai login for a fresh key",
+    log: recentTsnetLog()
+  };
+}
 async function buildPairing() {
   const token = requireToken();
   const cfg = loadConfig();
   const port2 = Number(process.env.SAKURA_PORT || cfg.daemon.port);
   const tsnet = readTsnetState();
   const tsnetUrl = tsnet?.tailscaleIp && tsnet.backendState === "Running" ? `http://${tsnet.tailscaleIp}:${port2}` : null;
-  const cliTailnet = tsnetUrl ? null : await discoverBaseUrl(port2).catch(() => null);
+  const ts = cfg.tailscale;
+  const configured = !!(ts?.controlUrl && ts?.authKey);
+  const cliTailnet = tsnetUrl || configured ? null : await discoverBaseUrl(port2).catch(() => null);
   const url = tsnetUrl ?? cliTailnet ?? `http://${localIp()}:${port2}`;
   const params = /* @__PURE__ */ new Map([
     ["url", url],
     ["token", token]
   ]);
-  const ts = cfg.tailscale;
-  const embeddedTailscale = !!(ts?.controlUrl && ts?.authKey);
+  const embeddedTailscale = configured && !!tsnetUrl;
   if (embeddedTailscale) {
     params.set("cn", ts.controlUrl);
     params.set("tskey", ts.authKey);
   }
   const query = [...params].map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
   const deepLink = `sakura://pair?${query}`;
-  return { url, token, deepLink, embeddedTailscale };
+  const tailnetProblem = configured && !tsnetUrl ? diagnoseTailnet(tsnet) : void 0;
+  return { url, token, deepLink, embeddedTailscale, tailnetProblem };
+}
+function tunnelUp() {
+  const ts = readTsnetState();
+  return !!(ts?.tailscaleIp && ts.backendState === "Running");
+}
+async function waitForTunnel(timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (tunnelUp()) return true;
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  return tunnelUp();
 }
 function renderQr(deepLink) {
   return new Promise((resolve) => {
@@ -4927,6 +5012,7 @@ var init_pairing = __esm({
     init_config();
     init_auth();
     init_tailscale();
+    init_tsnet();
   }
 });
 
@@ -4936,10 +5022,22 @@ __export(pair_exports, {
   registerPair: () => registerPair,
   showPairing: () => showPairing
 });
+import chalk2 from "chalk";
 async function showPairing(opts = {}) {
   const pairing = await buildPairing();
   if (opts.json) return printJson(pairing);
   const qr = await renderQr(pairing.deepLink);
+  const problem = pairing.tailnetProblem;
+  if (problem) {
+    info("");
+    warn(chalk2.bold("This Mac is not on Sakura\u2019s private tailnet, so this QR only works on the same Wi\u2011Fi."));
+    info(`  Why: ${problem.reason}`);
+    info(`  Fix: ${chalk2.cyan(problem.fix)}`);
+    if (problem.log.length) {
+      info("  Recent tailnet log:");
+      problem.log.forEach((l) => info(chalk2.dim(`    ${l}`)));
+    }
+  }
   info("");
   info("Scan this with your phone to pair the Sakura app:");
   info("");
@@ -4966,6 +5064,9 @@ function registerPair(program) {
     }
     if (!running()) {
       warn("The daemon is not running \u2014 start it with `sakuraai daemon start` so the app can connect.");
+    } else if (loadConfig().tailscale?.authKey && !tunnelUp()) {
+      info("Waiting for Sakura\u2019s private tunnel (up to 90s)\u2026");
+      await waitForTunnel(9e4);
     }
     await showPairing(opts);
     success("Waiting for the app to connect\u2026");
@@ -4975,6 +5076,7 @@ var init_pair = __esm({
   "src/commands/pair.ts"() {
     "use strict";
     init_pairing();
+    init_config();
     init_auth();
     init_manager();
     init_output();
@@ -4985,7 +5087,7 @@ var init_pair = __esm({
 import { Command } from "commander";
 
 // src/version.ts
-var VERSION = "0.0.14";
+var VERSION = "0.0.16";
 
 // src/index.ts
 init_config();
@@ -5048,23 +5150,12 @@ init_tailscale();
 init_auth();
 init_config();
 init_output();
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+init_pairing();
 async function tunnelUrl(port2) {
   const ts = readTsnetState();
   if (ts?.tailscaleIp && ts.backendState === "Running") return `http://${ts.tailscaleIp}:${port2}`;
   return await discoverBaseUrl(port2).catch(() => null);
 }
-async function waitForTunnel(timeoutMs) {
-  if (!getServerToken()) return false;
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const cfg = loadConfig();
-    const ts = readTsnetState();
-    if (cfg.tailscale?.controlUrl && ts?.tailscaleIp && ts.backendState === "Running") return true;
-    await sleep2(500);
-  }
-  return false;
-}
 function registerRuntime(program, version) {
   program.command("start").description("Run the Sakura runtime in this terminal (foreground)").option("--auth <token>", "sign in with a CLI token before starting").action(async (opts) => {
     if (opts.auth) {
@@ -5081,11 +5172,11 @@ function registerRuntime(program, version) {
     if (!isLoggedIn()) die("Not signed in. Run `sakuraai login` first.");
     const info0 = start();
     success(`Daemon running (pid ${info0.pid}) on ${info0.url}`);
-    const ready = await waitForTunnel(2e4);
-    if (ready) {
-      info("Embedded Tailscale tunnel up \u2014 the phone can connect from any network, no Tailscale app needed.");
-    } else if (getServerToken()) {
-      warn("Tunnel not up yet \u2014 pairing over LAN for now. Re-run `sakuraai pair` in a moment for the private URL.");
+    if (getServerToken() && loadConfig().tailscale?.controlUrl) {
+      info("Waiting for Sakura\u2019s private tunnel (up to 90s)\u2026");
+      if (await waitForTunnel(9e4)) {
+        info("Embedded Tailscale tunnel up \u2014 the phone can connect from any network, no Tailscale app needed.");
+      }
     }
     const { showPairing: showPairing2 } = await Promise.resolve().then(() => (init_pair(), pair_exports));
     await showPairing2();
@@ -5114,7 +5205,7 @@ function registerRuntime(program, version) {
 // src/commands/session.ts
 init_sessions();
 init_output();
-import fs23 from "fs";
+import fs24 from "fs";
 function resolveSessionId(arg) {
   const id = arg || process.env.SAKURA_SESSION_ID;
   if (!id) die("Provide a sessionId (positional or via SAKURA_SESSION_ID).");
@@ -5123,7 +5214,7 @@ function resolveSessionId(arg) {
 async function resolvePrompt(positional, opts) {
   if (positional) return positional;
   if (opts.prompt) return opts.prompt;
-  if (opts.promptFile) return fs23.readFileSync(opts.promptFile, "utf8");
+  if (opts.promptFile) return fs24.readFileSync(opts.promptFile, "utf8");
   if (!process.stdin.isTTY) {
     const chunks = [];
     for await (const c of process.stdin) chunks.push(c);
@@ -5438,14 +5529,14 @@ init_pair();
 
 // src/commands/welcome.ts
 init_config();
-import fs24 from "fs";
+import fs25 from "fs";
 import path20 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawn as spawn13 } from "child_process";
 var WELCOMED_MARKER = path20.join(SAKURA_DIR, ".welcomed");
 function resolveBinary2() {
   const envBin = process.env.SAKURA_ONBOARD_BIN;
-  if (envBin && fs24.existsSync(envBin)) return envBin;
+  if (envBin && fs25.existsSync(envBin)) return envBin;
   const here = path20.dirname(fileURLToPath2(import.meta.url));
   const name = process.platform === "win32" ? "sakura-onboard.exe" : "sakura-onboard";
   const candidates = [
@@ -5456,7 +5547,7 @@ function resolveBinary2() {
     path20.join(SAKURA_DIR, name)
     // user-dropped
   ];
-  return candidates.find((p) => fs24.existsSync(p)) ?? null;
+  return candidates.find((p) => fs25.existsSync(p)) ?? null;
 }
 function showWelcome() {
   return new Promise((resolve) => {
@@ -5474,10 +5565,10 @@ function showWelcome() {
   });
 }
 async function maybeFirstRunWelcome() {
-  if (fs24.existsSync(WELCOMED_MARKER)) return;
+  if (fs25.existsSync(WELCOMED_MARKER)) return;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return;
   try {
-    fs24.writeFileSync(WELCOMED_MARKER, (/* @__PURE__ */ new Date()).toISOString());
+    fs25.writeFileSync(WELCOMED_MARKER, (/* @__PURE__ */ new Date()).toISOString());
   } catch {
   }
   await showWelcome();
@@ -5515,7 +5606,7 @@ function registerWelcome(program) {
 }
 
 // src/commands/app.ts
-import fs25 from "fs";
+import fs26 from "fs";
 import os11 from "os";
 import path21 from "path";
 import { execFileSync as execFileSync4 } from "child_process";
@@ -5528,11 +5619,11 @@ function dmgUrl() {
 async function download(url, dest) {
   const res = await fetch(url, { redirect: "follow" });
   if (!res.ok) throw new Error(`download failed: HTTP ${res.status} for ${url}`);
-  fs25.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
+  fs26.writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
 }
 async function install() {
   if (process.platform !== "darwin") die("The Sakura menu bar app is macOS only.");
-  const tmp = fs25.mkdtempSync(path21.join(os11.tmpdir(), "sakura-app-"));
+  const tmp = fs26.mkdtempSync(path21.join(os11.tmpdir(), "sakura-app-"));
   const dmg = path21.join(tmp, "Sakura.dmg");
   const mount = path21.join(tmp, "mnt");
   info(`Downloading Sakura.app ${VERSION}\u2026`);
@@ -5542,18 +5633,18 @@ async function install() {
     die(`${e.message}
 Build it yourself instead: ./mac/scripts/build-dmg.sh in the Sakura repo.`);
   }
-  fs25.mkdirSync(mount);
+  fs26.mkdirSync(mount);
   execFileSync4("hdiutil", ["attach", dmg, "-nobrowse", "-quiet", "-mountpoint", mount]);
   try {
     try {
       execFileSync4("osascript", ["-e", 'tell application id "mom.sakura.mac" to quit']);
     } catch {
     }
-    fs25.rmSync(APP_PATH, { recursive: true, force: true });
+    fs26.rmSync(APP_PATH, { recursive: true, force: true });
     execFileSync4("ditto", [path21.join(mount, "Sakura.app"), APP_PATH]);
   } finally {
     execFileSync4("hdiutil", ["detach", mount, "-quiet"]);
-    fs25.rmSync(tmp, { recursive: true, force: true });
+    fs26.rmSync(tmp, { recursive: true, force: true });
   }
   execFileSync4("open", [APP_PATH]);
   success("Sakura is in your menu bar (look for the blossom).");
@@ -5562,7 +5653,7 @@ function registerApp(program) {
   const app = program.command("app").description("The optional Sakura menu bar app for macOS");
   app.command("install").description("Download Sakura.app into /Applications and open it").action(install);
   app.command("open").description("Open the Sakura menu bar app").action(() => {
-    if (!fs25.existsSync(APP_PATH)) die("Sakura.app is not installed. Run `sakuraai app install`.");
+    if (!fs26.existsSync(APP_PATH)) die("Sakura.app is not installed. Run `sakuraai app install`.");
     execFileSync4("open", [APP_PATH]);
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sakuraai",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "Sakura Agent CLI + local runtime for managing AI coding sessions (Claude Code, Codex, OpenCode, ZCode, DeepSeek) and reaching them privately from the Sakura mobile app over Tailscale",
   "type": "module",
   "main": "dist/index.js",