swayrouter 1.0.0

package/src/lib/tunnel/cloudflare/cloudflared.js

@@ -0,0 +1,436 @@
+import fs from "fs";
+import path from "path";
+import https from "https";
+import os from "os";
+import { execSync, spawn } from "child_process";
+import { savePid, loadPid, clearPid } from "./pid.js";
+import { DATA_DIR } from "@/lib/dataDir.js";
+
+const BIN_DIR = path.join(DATA_DIR, "bin");
+const BINARY_NAME = "cloudflared";
+const IS_WINDOWS = os.platform() === "win32";
+const BIN_NAME = IS_WINDOWS ? `${BINARY_NAME}.exe` : BINARY_NAME;
+const BIN_PATH = path.join(BIN_DIR, BIN_NAME);
+const POWERSHELL_HIDDEN_COMMAND = "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command";
+const DEFAULT_QUICK_TUNNEL_PROTOCOL = "http2";
+const QUICK_TUNNEL_PROTOCOLS = new Set(["http2", "quic", "auto"]);
+
+const GITHUB_BASE_URL = "https://github.com/cloudflare/cloudflared/releases/latest/download";
+
+const PLATFORM_MAPPINGS = {
+  darwin: {
+    x64: "cloudflared-darwin-amd64.tgz",
+    arm64: "cloudflared-darwin-arm64.tgz"
+  },
+  win32: {
+    x64: "cloudflared-windows-amd64.exe",
+    ia32: "cloudflared-windows-386.exe",
+    arm64: "cloudflared-windows-386.exe"
+  },
+  linux: {
+    x64: "cloudflared-linux-amd64",
+    arm64: "cloudflared-linux-arm64"
+  }
+};
+
+const PLATFORM_FALLBACK = {
+  darwin: "cloudflared-darwin-amd64.tgz",
+  win32: "cloudflared-windows-386.exe",
+  linux: "cloudflared-linux-amd64"
+};
+
+function getDownloadUrl() {
+  const platform = os.platform();
+  const arch = os.arch();
+
+  const platformMapping = PLATFORM_MAPPINGS[platform];
+  if (!platformMapping) {
+    throw new Error(`Unsupported platform: ${platform}`);
+  }
+
+  const binaryName = platformMapping[arch] || PLATFORM_FALLBACK[platform];
+  return `${GITHUB_BASE_URL}/${binaryName}`;
+}
+
+const dlState = { downloading: false, progress: 0 };
+
+export function getDownloadStatus() {
+  return { downloading: dlState.downloading, progress: dlState.progress };
+}
+
+function downloadFile(url, dest) {
+  return new Promise((resolve, reject) => {
+    const file = fs.createWriteStream(dest);
+
+    https.get(url, (response) => {
+      if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
+        file.close();
+        fs.unlinkSync(dest);
+        downloadFile(response.headers.location, dest).then(resolve).catch(reject);
+        return;
+      }
+
+      if (response.statusCode !== 200) {
+        file.close();
+        fs.unlinkSync(dest);
+        reject(new Error(`Download failed with status ${response.statusCode}`));
+        return;
+      }
+
+      const totalBytes = parseInt(response.headers["content-length"], 10) || 0;
+      let receivedBytes = 0;
+      dlState.downloading = true;
+      dlState.progress = 0;
+
+      response.on("data", (chunk) => {
+        receivedBytes += chunk.length;
+        if (totalBytes > 0) dlState.progress = Math.round((receivedBytes / totalBytes) * 100);
+      });
+
+      response.pipe(file);
+
+      file.on("finish", () => {
+        dlState.downloading = false;
+        dlState.progress = 100;
+        file.close(() => resolve(dest));
+      });
+
+      file.on("error", (err) => {
+        dlState.downloading = false;
+        dlState.progress = 0;
+        file.close();
+        fs.unlinkSync(dest);
+        reject(err);
+      });
+    }).on("error", (err) => {
+      dlState.downloading = false;
+      dlState.progress = 0;
+      file.close();
+      if (fs.existsSync(dest)) fs.unlinkSync(dest);
+      reject(err);
+    });
+  });
+}
+
+const MIN_BINARY_SIZE = 1024 * 1024;
+
+function isValidBinary(filePath) {
+  try {
+    const stat = fs.statSync(filePath);
+    if (stat.size < MIN_BINARY_SIZE) return false;
+    const fd = fs.openSync(filePath, "r");
+    const buf = Buffer.alloc(4);
+    fs.readSync(fd, buf, 0, 4, 0);
+    fs.closeSync(fd);
+    const magic = buf.toString("hex");
+    if (IS_WINDOWS) return magic.startsWith("4d5a");
+    if (os.platform() === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe");
+    return magic.startsWith("7f454c46");
+  } catch {
+    return false;
+  }
+}
+
+let downloadPromise = null;
+
+export async function ensureCloudflared() {
+  if (downloadPromise) return downloadPromise;
+  downloadPromise = _ensureCloudflared().finally(() => { downloadPromise = null; });
+  return downloadPromise;
+}
+
+async function _ensureCloudflared() {
+  if (!fs.existsSync(BIN_DIR)) {
+    fs.mkdirSync(BIN_DIR, { recursive: true });
+  }
+
+  const tmpPath = `${BIN_PATH}.tmp`;
+  if (fs.existsSync(tmpPath)) {
+    try { fs.unlinkSync(tmpPath); } catch {              }
+  }
+
+  if (fs.existsSync(BIN_PATH)) {
+    if (!isValidBinary(BIN_PATH)) {
+      console.log("[cloudflared] Invalid binary detected, re-downloading...");
+      fs.unlinkSync(BIN_PATH);
+    } else {
+      if (!IS_WINDOWS) fs.chmodSync(BIN_PATH, "755");
+      return BIN_PATH;
+    }
+  }
+
+  const url = getDownloadUrl();
+  const isArchive = url.endsWith(".tgz");
+  const downloadDest = isArchive ? path.join(BIN_DIR, "cloudflared.tgz.tmp") : tmpPath;
+
+  await downloadFile(url, downloadDest);
+
+  if (isArchive) {
+    execSync(`tar -xzf "${downloadDest}" -C "${BIN_DIR}"`, { stdio: "pipe", windowsHide: true });
+    fs.unlinkSync(downloadDest);
+  } else {
+    fs.renameSync(downloadDest, BIN_PATH);
+  }
+
+  if (!IS_WINDOWS) {
+    fs.chmodSync(BIN_PATH, "755");
+  }
+
+  return BIN_PATH;
+}
+
+let cloudflaredProcess = null;
+let unexpectedExitHandler = null;
+let intentionalKill = false;
+
+export function setUnexpectedExitHandler(handler) {
+  unexpectedExitHandler = handler;
+}
+
+export async function spawnCloudflared(tunnelToken) {
+  const binaryPath = await ensureCloudflared();
+
+  const child = spawn(binaryPath, ["tunnel", "run", "--dns-resolver-addrs", "1.1.1.1:53", "--token", tunnelToken], {
+    detached: false,
+    windowsHide: true,
+    cwd: os.tmpdir(),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+
+  cloudflaredProcess = child;
+  savePid(child.pid);
+
+  return new Promise((resolve, reject) => {
+    let connectionCount = 0;
+    let resolved = false;
+    const timeout = setTimeout(() => {
+      resolved = true;
+      resolve(child);
+    }, 90000);
+
+    const handleLog = (data) => {
+      const msg = data.toString();
+
+      const matches = msg.match(/Registered tunnel connection/g);
+      if (matches) {
+        connectionCount += matches.length;
+        if (connectionCount >= 4 && !resolved) {
+          resolved = true;
+          clearTimeout(timeout);
+          resolve(child);
+        }
+      }
+    };
+
+    child.stdout.on("data", handleLog);
+    child.stderr.on("data", handleLog);
+
+    child.on("error", (err) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+        reject(err);
+      }
+    });
+
+    child.on("exit", (code, signal) => {
+      if (cloudflaredProcess === child) cloudflaredProcess = null;
+      clearPid(child.pid);
+      const wasConnected = resolved;
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+
+        let stderrOutput = "";
+        if (child.stderr && !child.stderr.destroyed) {
+
+          stderrOutput = " Check cloudflared logs for details.";
+        }
+        if (code === 1) {
+
+          reject(new Error(`cloudflared exited with code ${code}${stderrOutput} Ensure your tunnel token is valid and network is reachable.`));
+        } else if (code === 2) {
+          reject(new Error(`cloudflared exited with code ${code}${stderrOutput} Check if required arguments are correct.`));
+        } else {
+          reject(new Error(`cloudflared exited with code ${code}${stderrOutput}`));
+        }
+        return;
+      }
+
+      if (intentionalKill) { intentionalKill = false; return; }
+      if (wasConnected && unexpectedExitHandler) unexpectedExitHandler();
+    });
+  });
+}
+
+export async function spawnQuickTunnel(localPort, onUrlUpdate) {
+  const binaryPath = await ensureCloudflared();
+
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "cloudflared-quick-"));
+  const configPath = path.join(configDir, "config.yml");
+
+  fs.writeFileSync(configPath, "# quick-tunnel config placeholder\n", "utf8");
+
+  let isCleaned = false;
+  const cleanup = () => {
+    if (isCleaned) return;
+    isCleaned = true;
+    try {
+      fs.rmSync(configDir, { recursive: true, force: true });
+    } catch (e) {              }
+  };
+
+  const requestedProtocol = String(process.env.TUNNEL_TRANSPORT_PROTOCOL || process.env.CLOUDFLARED_PROTOCOL || DEFAULT_QUICK_TUNNEL_PROTOCOL).trim().toLowerCase();
+  const tunnelProtocol = QUICK_TUNNEL_PROTOCOLS.has(requestedProtocol) ? requestedProtocol : DEFAULT_QUICK_TUNNEL_PROTOCOL;
+  const child = spawn(binaryPath, ["tunnel", "--url", `http://127.0.0.1:${localPort}`, "--config", configPath, "--no-autoupdate", "--retries", "99"], {
+    detached: false,
+    windowsHide: true,
+    cwd: os.tmpdir(),
+    env: {
+      ...process.env,
+      TUNNEL_TRANSPORT_PROTOCOL: tunnelProtocol,
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  cloudflaredProcess = child;
+  savePid(child.pid);
+
+  return new Promise((resolve, reject) => {
+    let resolved = false;
+
+    let logTail = "";
+
+    function getQuickTunnelUrlFromLog(message) {
+
+      const regex = /https:\/\/([a-z0-9-]+)\.trycloudflare\.com/gi;
+      const candidates = [];
+
+      for (const match of message.matchAll(regex)) {
+        const host = match[1];
+        if (host === "api") continue;
+        candidates.push(`https://${host}.trycloudflare.com`);
+      }
+
+      if (!candidates.length) return null;
+      return candidates[candidates.length - 1];
+    }
+
+    const timeout = setTimeout(() => {
+      if (resolved) return;
+      resolved = true;
+      cleanup();
+      reject(new Error(`Quick tunnel timed out. Last log: ${logTail.slice(-800) || "(empty)"}`));
+    }, 90000);
+
+    let lastUrl = null;
+
+    const handleLog = (data) => {
+      const msg = data.toString();
+      logTail = (logTail + msg).slice(-4000);
+      const tunnelUrl = getQuickTunnelUrlFromLog(msg);
+      if (!tunnelUrl) return;
+
+      if (!resolved) {
+
+        resolved = true;
+        lastUrl = tunnelUrl;
+        clearTimeout(timeout);
+        cleanup();
+        console.log(`[Tunnel] cloudflared URL: ${tunnelUrl}`);
+        resolve({ child, tunnelUrl });
+        return;
+      }
+
+      if (tunnelUrl !== lastUrl) {
+        console.log(`[Tunnel] cloudflared URL changed: ${tunnelUrl}`);
+        lastUrl = tunnelUrl;
+        if (onUrlUpdate) onUrlUpdate(tunnelUrl);
+      }
+    };
+
+    child.stdout.on("data", handleLog);
+    child.stderr.on("data", handleLog);
+
+    child.on("error", (err) => {
+      if (resolved) return;
+      resolved = true;
+      clearTimeout(timeout);
+      cleanup();
+      reject(err);
+    });
+
+    child.on("exit", (code, signal) => {
+      if (cloudflaredProcess === child) cloudflaredProcess = null;
+      clearPid(child.pid);
+
+      if (intentionalKill) {
+        intentionalKill = false;
+        clearTimeout(timeout);
+        cleanup();
+        if (!resolved) { resolved = true; reject(new Error("cloudflared killed")); }
+        return;
+      }
+      console.log(`[Tunnel] cloudflared exit code=${code} signal=${signal}`);
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+        cleanup();
+        const tail = logTail.slice(-600).trim() || "(empty)";
+        if (code === 1) {
+          reject(new Error(`cloudflared quick tunnel exited (code 1). Common causes: (1) outbound port 7844 (TCP/UDP) blocked, (2) TryCloudflare service issue, (3) cannot reach 127.0.0.1:${localPort}, (4) protocol (http2/quic) blocked by network. Last log: ${tail}`));
+        } else if (code === 2) {
+          reject(new Error(`cloudflared exited (code 2). Bad arguments. Last log: ${tail}`));
+        } else {
+          reject(new Error(`cloudflared exited (code ${code}). Last log: ${tail}`));
+        }
+        return;
+      }
+      if (unexpectedExitHandler) unexpectedExitHandler();
+      cleanup();
+    });
+  });
+}
+
+function killCloudflaredByPort(port) {
+  if (!port) return;
+  try {
+    if (IS_WINDOWS) {
+      const psCmd = `Get-CimInstance Win32_Process -Filter \\"Name='cloudflared.exe'\\" | Where-Object { $_.CommandLine -match ':${port}(\\D|$)' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }`;
+      execSync(`${POWERSHELL_HIDDEN_COMMAND} "${psCmd}"`, { stdio: "ignore", windowsHide: true });
+    } else {
+      execSync(`pkill -f "cloudflared.*:${port}([^0-9]|$)" 2>/dev/null || true`, { stdio: "ignore", windowsHide: true });
+    }
+  } catch (e) {              }
+}
+
+export function killCloudflared(localPort) {
+  intentionalKill = true;
+  if (cloudflaredProcess) {
+    try {
+      cloudflaredProcess.kill();
+    } catch (e) {              }
+    cloudflaredProcess = null;
+  }
+
+  const pid = loadPid();
+  if (pid) {
+    try {
+      process.kill(pid);
+    } catch (e) {              }
+    clearPid();
+  }
+
+  killCloudflaredByPort(localPort);
+}
+
+export function isCloudflaredRunning() {
+  const pid = loadPid();
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return false;
+  }
+}

package/src/lib/tunnel/cloudflare/config.js

@@ -0,0 +1,8 @@
+export const HEALTH_CHECK = {
+  intervalMs: 2000,
+  timeoutMs: 60000,
+  fetchTimeoutMs: 5000,
+  dnsTimeoutMs: 2000,
+};
+
+export const WORKER_URL = process.env.TUNNEL_WORKER_URL || "https://abc-tunnel.us";

package/src/lib/tunnel/cloudflare/healthCheck.js

@@ -0,0 +1,37 @@
+import { resolveDns } from "../shared/dnsResolver.js";
+import { HEALTH_CHECK } from "./config.js";
+
+function getHostname(url) {
+  try { return new URL(url).hostname; } catch { return null; }
+}
+
+function pause(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function probeUrlAlive(url) {
+  if (!url) return false;
+  const hostname = getHostname(url);
+  if (!hostname) return false;
+
+  if (!await resolveDns(hostname, HEALTH_CHECK.dnsTimeoutMs)) return false;
+
+  try {
+    const res = await fetch(`${url}/api/health`, {
+      signal: AbortSignal.timeout(HEALTH_CHECK.fetchTimeoutMs),
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+export async function waitForHealth(url, cancelToken = { cancelled: false }) {
+  const start = Date.now();
+  while (Date.now() - start < HEALTH_CHECK.timeoutMs) {
+    if (cancelToken.cancelled) throw new Error("cancelled");
+    if (await probeUrlAlive(url)) return true;
+    await pause(HEALTH_CHECK.intervalMs);
+  }
+  throw new Error(`Health check timeout after ${HEALTH_CHECK.timeoutMs}ms`);
+}

package/src/lib/tunnel/cloudflare/manager.js

@@ -0,0 +1,149 @@
+import { loadState, saveState, generateShortId } from "../shared/state.js";
+import { spawnQuickTunnel, killCloudflared, isCloudflaredRunning, setUnexpectedExitHandler } from "./cloudflared.js";
+import { clearPid } from "./pid.js";
+import { waitForHealth, probeUrlAlive } from "./healthCheck.js";
+import { WORKER_URL } from "./config.js";
+import { getPublicTunnelUrl } from "./publicUrl.js";
+import { getSettings, updateSettings } from "@/lib/localDb";
+
+const svc = {
+  cancelToken: { cancelled: false },
+  spawnInProgress: false,
+  lastRestartAt: 0,
+  activeLocalPort: null,
+};
+
+export function getTunnelService() { return svc; }
+export function isTunnelManuallyDisabled() { return svc.cancelToken.cancelled; }
+export function isTunnelReconnecting() { return svc.spawnInProgress; }
+
+let onUnexpectedExit = null;
+export function setTunnelUnexpectedExitCallback(cb) { onUnexpectedExit = cb; }
+
+async function registerTunnelUrl(shortId, tunnelUrl) {
+  await fetch(`${WORKER_URL}/api/tunnel/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ shortId, tunnelUrl })
+  });
+}
+
+function throwIfCancelled(token) {
+  if (token.cancelled) throw new Error("tunnel cancelled");
+}
+
+export async function enableTunnel(localPort = 14045) {
+  console.log(`[Tunnel] enable start (port=${localPort})`);
+  svc.cancelToken = { cancelled: false };
+  svc.activeLocalPort = localPort;
+  svc.spawnInProgress = true;
+  const token = svc.cancelToken;
+
+  try {
+    if (isCloudflaredRunning()) {
+      const existing = loadState();
+      if (existing?.tunnelUrl && existing?.shortId) {
+        const publicUrl = getPublicTunnelUrl(existing.shortId);
+
+        const [directOk, publicOk] = await Promise.all([
+          probeUrlAlive(existing.tunnelUrl),
+          probeUrlAlive(publicUrl),
+        ]);
+        if (directOk && publicOk) {
+          console.log(`[Tunnel] already running, reuse: ${existing.tunnelUrl}`);
+          return { success: true, tunnelUrl: existing.tunnelUrl, shortId: existing.shortId, publicUrl, alreadyRunning: true };
+        }
+        console.log(`[Tunnel] stale (direct=${directOk} public=${publicOk}), respawn`);
+      }
+    }
+
+    killCloudflared(localPort);
+    console.log("[Tunnel] killed existing cloudflared");
+    throwIfCancelled(token);
+
+    const existing = loadState();
+    const shortId = existing?.shortId || generateShortId();
+
+    const onUrlUpdate = async (url) => {
+      if (token.cancelled) return;
+      console.log(`[Tunnel] url updated: ${url}`);
+      await registerTunnelUrl(shortId, url);
+      saveState({ shortId, tunnelUrl: url });
+      await updateSettings({ tunnelEnabled: true, tunnelUrl: url });
+    };
+
+    setUnexpectedExitHandler(() => {
+      console.warn("[Tunnel] cloudflared exited unexpectedly, scheduling respawn");
+      if (onUnexpectedExit) onUnexpectedExit();
+    });
+
+    const { tunnelUrl } = await spawnQuickTunnel(localPort, onUrlUpdate);
+    console.log(`[Tunnel] spawned: ${tunnelUrl}`);
+    throwIfCancelled(token);
+
+    const publicUrl = getPublicTunnelUrl(shortId);
+    await registerTunnelUrl(shortId, tunnelUrl);
+    saveState({ shortId, tunnelUrl });
+    await updateSettings({ tunnelEnabled: true, tunnelUrl });
+    console.log(`[Tunnel] registered shortId=${shortId} publicUrl=${publicUrl}`);
+
+    await waitForHealth(publicUrl, token);
+    console.log("[Tunnel] public URL healthy");
+
+    if (!(await probeUrlAlive(tunnelUrl))) {
+      console.warn("[Tunnel] direct URL not reachable yet, continuing via publicUrl");
+    } else {
+      console.log("[Tunnel] direct URL healthy");
+    }
+
+    console.log("[Tunnel] enable success");
+    return { success: true, tunnelUrl, shortId, publicUrl };
+  } catch (e) {
+
+    if (!/cloudflared killed|tunnel cancelled/.test(e.message)) {
+      console.error(`[Tunnel] enable error: ${e.message}`);
+    }
+    throw e;
+  } finally {
+    svc.spawnInProgress = false;
+  }
+}
+
+export async function disableTunnel() {
+  console.log("[Tunnel] disable");
+
+  svc.cancelToken.cancelled = true;
+  setUnexpectedExitHandler(null);
+
+  try { killCloudflared(svc.activeLocalPort); } catch (e) { console.warn(`[Tunnel] kill warn: ${e.message}`); }
+  clearPid();
+
+  const state = loadState();
+  if (state) saveState({ shortId: state.shortId, tunnelUrl: null });
+
+  await updateSettings({ tunnelEnabled: false, tunnelUrl: "" });
+
+  svc.spawnInProgress = false;
+  svc.activeLocalPort = null;
+  return { success: true };
+}
+
+export async function getTunnelStatus() {
+  const settings = await getSettings();
+  const settingsEnabled = settings.tunnelEnabled === true;
+  const state = loadState();
+  const shortId = state?.shortId || "";
+  const publicUrl = getPublicTunnelUrl(shortId);
+  const tunnelUrl = state?.tunnelUrl || "";
+
+  const running = settingsEnabled ? isCloudflaredRunning() : false;
+
+  return {
+    enabled: settingsEnabled && running,
+    settingsEnabled,
+    tunnelUrl,
+    shortId,
+    publicUrl,
+    running
+  };
+}

package/src/lib/tunnel/cloudflare/pid.js

@@ -0,0 +1,31 @@
+import fs from "fs";
+import path from "path";
+import { TUNNEL_DIR, ensureTunnelDir } from "../shared/state.js";
+
+const PID_FILE = path.join(TUNNEL_DIR, "cloudflared.pid");
+
+function pidFileExists() {
+  return fs.existsSync(PID_FILE);
+}
+
+export function savePid(pid) {
+  ensureTunnelDir();
+  fs.writeFileSync(PID_FILE, pid.toString());
+}
+
+export function loadPid() {
+  try {
+    if (pidFileExists()) return parseInt(fs.readFileSync(PID_FILE, "utf8"));
+  } catch {}
+  return null;
+}
+
+export function clearPid(expectedPid = null) {
+  try {
+    if (!pidFileExists()) return false;
+    if (expectedPid !== null && loadPid() !== expectedPid) return false;
+    fs.unlinkSync(PID_FILE);
+    return true;
+  } catch {}
+  return false;
+}

package/src/lib/tunnel/cloudflare/publicUrl.js

@@ -0,0 +1,41 @@
+const PUBLIC_TUNNEL_DOMAIN = "abc-tunnel.us";
+
+export function getPublicTunnelUrl(shortId) {
+  const id = String(shortId || "").trim().toLowerCase();
+  return id ? `https://r${id}.${PUBLIC_TUNNEL_DOMAIN}` : "";
+}
+
+function hostnameFromUrl(value) {
+  if (!value) return "";
+  try {
+    return new URL(value).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+
+function hostnameFromHeader(value) {
+  const raw = String(value || "").trim().toLowerCase();
+  if (!raw) return "";
+  return raw.replace(/^\[|\]$/g, "").split(":")[0];
+}
+
+export function getTunnelHosts(settings, state) {
+  const hosts = new Set();
+  const directHost = hostnameFromUrl(settings?.tunnelUrl);
+  if (directHost) hosts.add(directHost);
+
+  if (settings?.tunnelEnabled === true) {
+    const publicHost = hostnameFromUrl(getPublicTunnelUrl(state?.shortId));
+    if (publicHost) hosts.add(publicHost);
+  }
+
+  return hosts;
+}
+
+export function isTunnelHost(hostHeader, settings, state) {
+  const host = hostnameFromHeader(hostHeader);
+  return Boolean(host && getTunnelHosts(settings, state).has(host));
+}
+
+export const __test__ = { hostnameFromHeader, hostnameFromUrl };