skydive-cli 0.4.1-beta.6 → 0.5.0-beta.10

package/dist/js/{daemon-CfbpCjAw.mjs → daemon-CYYE2BTu.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { s as isRecord, t as PortalClient } from "./client-mykp1DVb.mjs";
+import { n as isRecord, t as PortalClient } from "./client-DabRpc_T.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -8,6 +8,43 @@ import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
 import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 
+//#region ../portal-daemon/src/build-stamp.ts
+/**
+* This build's stamp: the unix commit time (seconds) of the source it was
+* compiled from. Empty string when unstamped (a dev source run without the
+* env override).
+*
+* Why a commit time and not a package version: the daemon ships inside two
+* independently-versioned installers (the skydive CLI and the desktop app),
+* so their semvers are not comparable — but both build from this repo, so
+* the commit time of the built tree is one monotonic clock they share.
+*/
+function portalDaemonBuild() {
+	return "1786598530";
+}
+/**
+* Whether a client carrying `mine` should replace a running daemon carrying
+* `theirs` (newest build wins):
+*
+*  - an unstamped client never takes over — it can't prove it's newer;
+*  - a stamped client replaces an unstamped daemon — every stamped build
+*    postdates stamping, so the unstamped daemon is older by construction;
+*  - otherwise strictly greater wins; equal keeps the incumbent, so two
+*    identical builds never bounce the daemon between them.
+*/
+function isNewerBuild(mine, theirs) {
+	const mineAt = parseStamp(mine);
+	if (mineAt === null) return false;
+	const theirsAt = parseStamp(theirs);
+	if (theirsAt === null) return true;
+	return mineAt > theirsAt;
+}
+function parseStamp(stamp) {
+	if (!/^[0-9]+$/.test(stamp)) return null;
+	return Number(stamp);
+}
+
+//#endregion
 //#region ../portal-daemon/src/local-protocol.ts
 /**
 * Local IPC between the portal DAEMON and the `skydive` CLI processes attached
@@ -47,14 +84,35 @@ const LOCAL_PROTOCOL_VERSION = 1;
 */
 const PORTAL_DAEMON_FLAG = "--skydive-internal-portal-daemon";
 /**
+* One daemon per machine requires one socket key per backend — but the prod
+* backend is reachable under three hosts: the CLI's default appUrl is
+* `https://api.skydive.com` while the desktop app carries
+* `https://skydive.com` (and the web is on www). Hashing those raw strings
+* would give each surface its own daemon, and with the merged machine
+* identity both daemons would register the SAME device — the presence
+* contention the daemon exists to prevent. Collapse the known prod aliases to
+* the CLI's canonical form (proven for both the REST surface and the WS
+* upgrade; the apex 301-redirects, which a WS upgrade cannot follow).
+* Non-prod URLs (previews, localhost) pass through untouched apart from
+* trailing-slash trimming.
+*/
+function canonicalPortalAppUrl(appUrl) {
+	const trimmed = appUrl.replace(/\/+$/, "");
+	const host = trimmed.replace(/^https?:\/\//, "").toLowerCase();
+	if (host === "skydive.com" || host === "www.skydive.com" || host === "api.skydive.com") return "https://api.skydive.com";
+	return trimmed;
+}
+/**
 * Per-user, per-app daemon socket + state paths. Scoped by OS user and a hash
-* of the appUrl so two logins or two deployments (prod vs a PR preview) get
-* distinct daemons and never share a portal identity. Kept under the OS temp
-* dir because Unix socket paths are length-limited (~104 bytes on macOS).
+* of the CANONICAL appUrl so two logins or two deployments (prod vs a PR
+* preview) get distinct daemons and never share a portal identity — while
+* every alias of one deployment (see {@link canonicalPortalAppUrl}) shares
+* one. Kept under the OS temp dir because Unix socket paths are
+* length-limited (~104 bytes on macOS).
 */
 function daemonPaths(appUrl) {
 	const user = safeSegment(os.userInfo().username || "user");
-	const app = createHash("sha256").update(appUrl).digest("hex").slice(0, 12);
+	const app = createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12);
 	const dir = path.join(os.tmpdir(), `skydive-portal-${user}-${app}`);
 	return {
 		dir,
@@ -67,17 +125,30 @@ function safeSegment(value) {
 	return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 24) || "user";
 }
 /**
-* `hello` — a CLI attaches. `sessionId` is unique per CLI process; `token` is
-* the CLI's session token, which the daemon needs to mint the portal device
-* token (the daemon is spawned lazily and holds no session of its own). The
-* daemon uses the FIRST hello's token to connect and refreshes from later
-* hellos so a long-lived daemon can outlive the CLI that spawned it.
+* `hello` — a client attaches. `sessionId` is unique per client process.
+* `token` authenticates the daemon's portal connection; `tokenKind` says what
+* it is:
+*
+*  - `session` — a CLI session token. The daemon mints short-lived portal
+*    device tokens from it, and can call the session-authed portal REST
+*    surface (device refresh, grants).
+*  - `device` — a pre-minted portal device token (the desktop app is handed
+*    one by the web bridge and holds no session of its own). Dials the portal
+*    WebSocket directly; the session-only REST surface is unavailable until
+*    some client supplies a session token.
+*
+* The daemon uses the FIRST hello's token to connect and refreshes from later
+* hellos so a long-lived daemon can outlive the client that spawned it.
+* `tokenKind` defaults to `session` on parse: hellos from CLI builds that
+* predate the field are session-token clients by definition, and the default
+* keeps them attaching to a newer daemon.
 */
 const clientHelloSchema = z.object({
 	t: z.literal("hello"),
 	v: z.number(),
 	sessionId: z.string().min(1),
-	token: z.string().min(1)
+	token: z.string().min(1),
+	tokenKind: z.enum(["session", "device"]).default("session")
 });
 /**
 * `bind` — associate a conversation with a working directory. Sent on chat
@@ -104,10 +175,32 @@ const clientCwdSchema = z.object({
 	t: z.literal("cwd"),
 	cwd: z.string().min(1)
 });
-/** `grant` — authorize one agent to reach this machine (user-initiated). */
+/**
+* `grant` — authorize one agent to reach this machine (user-initiated).
+* `conversationId` names the conversation whose run asked for access (the
+* in-chat approval card); the grant carries it upstream so the server wakes
+* the waiting agent. Defaults to null on parse so hellos from CLI builds that
+* predate the field keep granting against a newer daemon — they just skip the
+* wake, same as before the field existed.
+*/
 const clientGrantSchema = z.object({
 	t: z.literal("grant"),
-	agentId: z.string().min(1)
+	agentId: z.string().min(1),
+	conversationId: z.string().nullish().default(null)
+});
+/**
+* `decline` — the user answered no to an agent's request for this machine
+* (`declined: true`), or re-opened the door for it (`declined: false`).
+*
+* The daemon holds this because a decline is about the MACHINE, not one
+* terminal: every attached CLI raises its own grant prompt off the daemon's
+* shared state, so a per-process no would be re-asked by every other open
+* conversation and by the next `skydive` launch.
+*/
+const clientDeclineSchema = z.object({
+	t: z.literal("decline"),
+	agentId: z.string().min(1),
+	declined: z.boolean()
 });
 /** `bye` — a CLI detaches cleanly (its conversations drop from the map). */
 const clientByeSchema = z.object({
@@ -133,6 +226,7 @@ const clientMessageSchema = z.discriminatedUnion("t", [
 	clientDisableSchema,
 	clientCwdSchema,
 	clientGrantSchema,
+	clientDeclineSchema,
 	clientByeSchema,
 	clientStatusSchema,
 	clientShutdownSchema
@@ -152,7 +246,8 @@ const daemonStateSchema = z.object({
 	machineName: z.string(),
 	friendlyName: z.string(),
 	error: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
+	grantedAgentIds: z.array(z.string()),
+	declinedAgentIds: z.array(z.string()).default([])
 });
 /** `hello_ok` — the daemon accepts an attach and reports its protocol version. */
 const daemonHelloOkSchema = z.object({
@@ -170,6 +265,7 @@ const daemonStatusResultSchema = z.object({
 	v: z.number(),
 	pid: z.number(),
 	appUrl: z.string(),
+	build: z.string().default(""),
 	portal: z.object({
 		status: z.enum([
 			"off",
@@ -180,7 +276,8 @@ const daemonStatusResultSchema = z.object({
 		machineName: z.string(),
 		friendlyName: z.string(),
 		error: z.string().nullable(),
-		grantedAgentIds: z.array(z.string())
+		grantedAgentIds: z.array(z.string()),
+		declinedAgentIds: z.array(z.string()).default([])
 	}),
 	clientCount: z.number(),
 	cwds: z.record(z.string(), z.string())
@@ -190,6 +287,12 @@ const daemonMessageSchema = z.discriminatedUnion("t", [
 	daemonHelloOkSchema,
 	daemonStatusResultSchema
 ]);
+/**
+* Encoding is the pre-parse direction, so it takes the schemas' INPUT types:
+* fields with a `.default()` (e.g. `hello.tokenKind`) are required after a
+* parse but optional on the wire, and a sender omitting one — an older CLI
+* build that predates the field — must stay expressible.
+*/
 function encodeLine(msg) {
 	return `${JSON.stringify(msg)}\n`;
 }
@@ -254,18 +357,21 @@ function parseDaemonMessage(line) {
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
 var PortalDaemon = class {
+	appUrl;
 	paths;
 	server = null;
 	client = null;
 	lastState = null;
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
+	declined = /* @__PURE__ */ new Set();
 	fallbackCwd;
 	idleTimer = null;
 	sessionToken = null;
+	deviceToken = null;
 	constructor(appUrl) {
-		this.appUrl = appUrl;
-		this.paths = daemonPaths(appUrl);
+		this.appUrl = canonicalPortalAppUrl(appUrl);
+		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
@@ -319,13 +425,14 @@ var PortalDaemon = class {
 		switch (msg.t) {
 			case "hello":
 				conn.sessionId = msg.sessionId;
-				this.sessionToken = msg.token;
+				if (msg.tokenKind === "device") this.deviceToken = msg.token;
+				else this.sessionToken = msg.token;
 				this.ensureClient();
 				this.send(conn, {
 					t: "hello_ok",
 					v: LOCAL_PROTOCOL_VERSION
 				});
-				if (this.lastState) this.send(conn, stateMessage(this.lastState));
+				if (this.lastState) this.send(conn, stateMessage(this.lastState, this.declined));
 				return;
 			case "bind":
 				conn.conversations.add(msg.conversationId);
@@ -342,12 +449,21 @@ var PortalDaemon = class {
 				for (const other of this.conns) other.wantsShare = false;
 				this.client?.disable();
 				return;
+			case "decline":
+				if (msg.declined) {
+					this.declined.add(msg.agentId);
+					if ((this.lastState?.grantedAgentIds.length ?? 0) === 0) this.client?.disable();
+				} else this.declined.delete(msg.agentId);
+				this.persistState();
+				this.broadcastState();
+				return;
 			case "cwd":
 				this.fallbackCwd = msg.cwd;
 				return;
 			case "grant":
+				this.declined.delete(msg.agentId);
 				this.ensureClient();
-				this.client?.grantAgent(msg.agentId).catch((error) => {
+				this.client?.grantAgent(msg.agentId, msg.conversationId).catch((error) => {
 					this.logError("grantAgent failed", error);
 				});
 				return;
@@ -375,14 +491,17 @@ var PortalDaemon = class {
 	}
 	/** Create the single PortalClient the first time a client needs the portal. */
 	ensureClient() {
-		if (this.client || !this.sessionToken) return;
+		if (this.client || !this.sessionToken && !this.deviceToken) return;
 		this.client = new PortalClient({
 			appUrl: this.appUrl,
-			sessionToken: this.sessionToken,
+			credentials: () => ({
+				sessionToken: this.sessionToken,
+				deviceToken: this.deviceToken
+			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
 			onState: (state) => {
 				this.lastState = state;
-				this.broadcast(stateMessage(state));
+				this.broadcastState();
 			}
 		});
 	}
@@ -400,6 +519,11 @@ var PortalDaemon = class {
 	broadcast(msg) {
 		for (const conn of this.conns) this.send(conn, msg);
 	}
+	/** Push the current portal state (plus the machine's declines) to every CLI. */
+	broadcastState() {
+		if (!this.lastState) return;
+		this.broadcast(stateMessage(this.lastState, this.declined));
+	}
 	armIdleTimer() {
 		this.clearIdleTimer();
 		this.idleTimer = setTimeout(() => this.shutdown(), IDLE_SHUTDOWN_MS);
@@ -417,6 +541,13 @@ var PortalDaemon = class {
 		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
+	/** Close the listener without exiting the process (tests own the process). */
+	stopForTest() {
+		this.clearIdleTimer();
+		this.client?.dispose();
+		this.server?.close();
+		this.server = null;
+	}
 	shutdown() {
 		if (this.conns.size > 0) return;
 		this.client?.dispose();
@@ -431,12 +562,14 @@ var PortalDaemon = class {
 			v: LOCAL_PROTOCOL_VERSION,
 			pid: process.pid,
 			appUrl: this.appUrl,
+			build: portalDaemonBuild(),
 			portal: {
 				status: portal?.status ?? "off",
 				machineName: portal?.machineName ?? "",
 				friendlyName: portal?.friendlyName ?? "",
 				error: portal?.error ?? null,
-				grantedAgentIds: portal?.grantedAgentIds ?? []
+				grantedAgentIds: portal?.grantedAgentIds ?? [],
+				declinedAgentIds: [...this.declined]
 			},
 			clientCount: [...this.conns].filter((c) => c.sessionId !== null).length,
 			cwds: Object.fromEntries(this.cwds)
@@ -462,13 +595,17 @@ var PortalDaemon = class {
 			const parsed = JSON.parse(raw);
 			if (isRecord(parsed) && parsed.version === LOCAL_PROTOCOL_VERSION && isRecord(parsed.cwds)) {
 				for (const [id, cwd] of Object.entries(parsed.cwds)) if (typeof cwd === "string") this.cwds.set(id, cwd);
+				if (Array.isArray(parsed.declined)) {
+					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
+				}
 			}
 		} catch (_error) {}
 	}
 	persistState() {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
-			cwds: Object.fromEntries(this.cwds)
+			cwds: Object.fromEntries(this.cwds),
+			declined: [...this.declined]
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -483,10 +620,23 @@ var PortalDaemon = class {
 * before dispatching a normal command — the same pattern the update-check
 * worker uses, so it survives bundling (import.meta.url points at the bundle,
 * not a standalone daemon module).
+*
+* Newest build wins: the daemon is embedded in two independently-updated
+* installers (the skydive CLI and the desktop app), and whoever spawned first
+* would otherwise hold the socket forever — a stale desktop daemon serving a
+* newer CLI indefinitely. So when a daemon is already listening, compare its
+* build stamp to ours: if ours is strictly newer, ask it to shut down (it
+* drains attached clients, who reconnect within ~500ms) and spawn from this
+* binary. Both spawners apply the same rule, so a host converges on the
+* newest installed build with at most one bounce.
 */
 async function ensureDaemonRunning(appUrl) {
 	const { socketPath } = daemonPaths(appUrl);
-	if (await isDaemonListening(socketPath)) return;
+	if (await isDaemonListening(socketPath)) {
+		const status = await queryDaemonStatus(appUrl);
+		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
+		if (await stopDaemon(appUrl) === "failed") return;
+	}
 	const entry = process.argv[1];
 	const args = entry ? [
 		entry,
@@ -615,14 +765,15 @@ async function stopDaemon(appUrl) {
 	}
 	return await isDaemonListening(socketPath) ? "failed" : "stopped";
 }
-function stateMessage(state) {
+function stateMessage(state, declined) {
 	return {
 		t: "state",
 		status: state.status,
 		machineName: state.machineName,
 		friendlyName: state.friendlyName,
 		error: state.error,
-		grantedAgentIds: state.grantedAgentIds
+		grantedAgentIds: state.grantedAgentIds,
+		declinedAgentIds: [...declined]
 	};
 }
 function sleep(ms) {

package/dist/js/{daemon-D4ZX3wNG.mjs → daemon-Dk5LeS1S.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import "./client-mykp1DVb.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-CfbpCjAw.mjs";
+import "./client-DabRpc_T.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-CYYE2BTu.mjs";
+import "./api-DG5W6iwx.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-client-6xtta_n2.mjs → daemon-client-3A9afTFC.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-CfbpCjAw.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-CYYE2BTu.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
@@ -12,7 +12,8 @@ var PortalDaemonClient = class {
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
-	pendingGrants = /* @__PURE__ */ new Set();
+	pendingGrants = /* @__PURE__ */ new Map();
+	pendingDeclines = /* @__PURE__ */ new Map();
 	grantedAgentIds = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.opts = opts;
@@ -35,7 +36,8 @@ var PortalDaemonClient = class {
 				t: "hello",
 				v: LOCAL_PROTOCOL_VERSION,
 				sessionId: this.sessionId,
-				token: this.opts.sessionToken
+				token: this.opts.sessionToken,
+				tokenKind: "session"
 			});
 			if (this.wantEnabled) this.send({ t: "enable" });
 			if (this.fallbackCwd) this.send({
@@ -48,9 +50,15 @@ var PortalDaemonClient = class {
 				conversationId: this.lastBind.conversationId,
 				cwd: this.lastBind.cwd
 			});
-			for (const agentId of this.pendingGrants) this.send({
+			for (const [agentId, conversationId] of this.pendingGrants) this.send({
 				t: "grant",
-				agentId
+				agentId,
+				conversationId
+			});
+			for (const [agentId, declined] of this.pendingDeclines) this.send({
+				t: "decline",
+				agentId,
+				declined
 			});
 		});
 		socket.on("data", (chunk) => {
@@ -82,7 +90,8 @@ var PortalDaemonClient = class {
 				machineName: msg.machineName,
 				friendlyName: msg.friendlyName,
 				error: msg.error,
-				grantedAgentIds: msg.grantedAgentIds
+				grantedAgentIds: msg.grantedAgentIds,
+				declinedAgentIds: msg.declinedAgentIds
 			});
 		}
 	}
@@ -108,6 +117,19 @@ var PortalDaemonClient = class {
 		this.send({ t: "disable" });
 	}
 	/**
+	* Record that the user said no (or yes again) to one agent on this machine.
+	* The daemon owns the answer, so every attached CLI stops asking — and it
+	* closes the share when nothing else is granted.
+	*/
+	decline(agentId, declined) {
+		this.pendingDeclines.set(agentId, declined);
+		this.send({
+			t: "decline",
+			agentId,
+			declined
+		});
+	}
+	/**
 	* Set the directory an exec runs in when the daemon can't place its
 	* conversation. `skydive portal open` shares one directory and has no
 	* conversation of its own, so this is how it routes.
@@ -136,13 +158,16 @@ var PortalDaemonClient = class {
 	* Authorize one agent to run commands on this machine. Resolves once the
 	* request is sent to the daemon (the daemon performs the grant and pushes the
 	* updated state); kept async so it's a drop-in for the old in-process client's
-	* awaited `grantAgent`.
+	* awaited `grantAgent`. `conversationId` names the conversation whose run
+	* asked, so the grant can wake the waiting agent; null when the grant is not
+	* answering an in-chat request.
 	*/
-	grantAgent(agentId) {
-		this.pendingGrants.add(agentId);
+	grantAgent(agentId, conversationId) {
+		this.pendingGrants.set(agentId, conversationId);
 		this.send({
 			t: "grant",
-			agentId
+			agentId,
+			conversationId
 		});
 		return Promise.resolve();
 	}

package/dist/js/daemon-client-Dh7G9RxC.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client-DabRpc_T.mjs";
+import "./daemon-CYYE2BTu.mjs";
+import "./api-DG5W6iwx.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-3A9afTFC.mjs";
+
+export { PortalDaemonClient };

package/dist/js/forward-18QoL5dO.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+import { t as fetchForwardTarget } from "./api-DG5W6iwx.mjs";
+import net from "node:net";
+import { WebSocket, createWebSocketStream } from "ws";
+
+//#region src/chat/portal/forward.ts
+const TARGET_REFRESH_SAFETY_MS = 12e4;
+/**
+* The reverse portal's client half: listen on the local machine's loopback and
+* pipe each TCP connection to the agent sandbox's daemon (`/portal/tcp`),
+* which pipes to the sandbox's own loopback. The daemon is reached through the
+* agent-webserver edge Worker (sandboxes have public ingress disabled; the
+* Worker owns boot-resolution and injects the sandbox edge-auth token), so a
+* sandbox recycle just costs the next connection a cold-start wait rather
+* than invalidating the forward.
+*/
+async function startForward({ auth, agentId, localPort, targetPort, log }) {
+	let target = await fetchForwardTarget(auth, agentId);
+	let mintedAt = Date.now();
+	async function freshTarget() {
+		const ttlMs = target.expiresInSeconds * 1e3;
+		if (Date.now() - mintedAt > ttlMs - TARGET_REFRESH_SAFETY_MS) {
+			target = await fetchForwardTarget(auth, agentId);
+			mintedAt = Date.now();
+		}
+		return target;
+	}
+	const server = net.createServer((sock) => {
+		sock.pause();
+		(async () => {
+			let resolved;
+			try {
+				resolved = await freshTarget();
+			} catch (err) {
+				log(`forward: token refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+				sock.destroy();
+				return;
+			}
+			const ws = new WebSocket(`${resolved.daemonOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${resolved.token}` } });
+			ws.on("open", () => {
+				const stream = createWebSocketStream(ws);
+				stream.on("error", () => sock.destroy());
+				sock.on("error", () => stream.destroy());
+				sock.pipe(stream).pipe(sock);
+				sock.resume();
+			});
+			ws.on("error", (err) => {
+				log(`forward: tunnel connect failed: ${err.message}`);
+				sock.destroy();
+			});
+		})();
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(localPort, "127.0.0.1", () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	const addr = server.address();
+	return {
+		port: addr && typeof addr === "object" ? addr.port : localPort,
+		close: () => new Promise((resolve) => server.close(() => resolve()))
+	};
+}
+
+//#endregion
+export { startForward };

package/dist/js/{print-ba_0hiV9.mjs → print-Bo06tvfV.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-CbayCa87.mjs";
-import "./rest-BY2nADw5.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-ClPkgR9z.mjs";
+import "./rest-I3imNduB.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };