uplink-cli 0.1.38 → 0.2.0

package/cli/src/subcommands/domains.ts

@@ -0,0 +1,295 @@
+import { Command } from "commander";
+import { launchDomainking } from "../utils/launchDomainking";
+import { handleError, printJson } from "../utils/machine";
+import {
+  adapters,
+  getAdapter,
+  isProviderId,
+  readRegistrarStore,
+  removeProvider,
+  saveProvider,
+  type DomainQuote,
+  type InventoryDomain,
+  type ProviderId,
+  type RegistrarCredentials,
+} from "../registrars";
+import { canPrompt, promptSecret, readEnvValue } from "../registrars/secret";
+import {
+  checkDomainAvailability,
+  formatPublicAvailability,
+} from "../utils/domain-availability";
+
+// DreamHost last: it can only confirm ownership, not quote availability.
+const CHECK_ORDER: ProviderId[] = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost"];
+
+function parseProvider(raw?: string): ProviderId | undefined {
+  if (!raw) return undefined;
+  const id = raw.toLowerCase();
+  if (!isProviderId(id)) throw new Error(`Unknown provider: ${raw}`);
+  return id;
+}
+
+async function credentialsFromFlags(
+  provider: ProviderId,
+  opts: { tokenEnv?: string; userEnv?: string; accountEnv?: string; json?: boolean }
+): Promise<RegistrarCredentials> {
+  const interactive = canPrompt() && !opts.json;
+
+  if (provider === "namecheap") {
+    const apiKey = opts.tokenEnv
+      ? readEnvValue(opts.tokenEnv)
+      : interactive
+        ? await promptSecret("Namecheap API key: ")
+        : "";
+    const apiUser = opts.userEnv
+      ? readEnvValue(opts.userEnv)
+      : interactive
+        ? await promptSecret("Namecheap API user: ")
+        : "";
+    if (!apiKey || !apiUser) {
+      throw new Error(
+        "Namecheap needs --token-env NAMECHEAP_API_KEY and --user-env NAMECHEAP_API_USER"
+      );
+    }
+    return { apiKey, apiUser };
+  }
+
+  // --token-env accepts a comma-separated list of env names for providers
+  // with multiple accounts (e.g. dreamhost).
+  const envNames = (opts.tokenEnv || "")
+    .split(",")
+    .map((name) => name.trim())
+    .filter(Boolean);
+  const tokens = envNames.length
+    ? envNames.map((name) => readEnvValue(name))
+    : interactive
+      ? [await promptSecret(`${provider} API token: `)].filter(Boolean)
+      : [];
+  if (tokens.length === 0 || !tokens[0]) {
+    throw new Error(`${provider} needs --token-env <VAR> (do not pass the secret on the command line)`);
+  }
+  const creds: RegistrarCredentials = { token: tokens[0] };
+  if (tokens.length > 1) creds.extraTokens = tokens.slice(1);
+  if (opts.accountEnv) creds.accountId = readEnvValue(opts.accountEnv);
+  return creds;
+}
+
+async function listInventory(providerFilter?: ProviderId): Promise<InventoryDomain[]> {
+  const store = readRegistrarStore();
+  const ids = providerFilter ? [providerFilter] : CHECK_ORDER.filter((id) => store[id]);
+  const domains: InventoryDomain[] = [];
+  const errors: string[] = [];
+  for (const id of ids) {
+    const creds = store[id];
+    if (!creds) {
+      if (providerFilter) throw new Error(`${id} is not connected`);
+      continue;
+    }
+    try {
+      const listed = await getAdapter(id).listDomains(creds);
+      domains.push(...listed);
+    } catch (error) {
+      errors.push(`${id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  if (domains.length === 0 && errors.length > 0) {
+    throw new Error(errors.join("; "));
+  }
+  return domains.sort((a, b) => a.domain.localeCompare(b.domain));
+}
+
+async function quoteDomain(domain: string, providerFilter?: ProviderId): Promise<DomainQuote> {
+  const store = readRegistrarStore();
+  const ids = providerFilter
+    ? [providerFilter]
+    : CHECK_ORDER.filter((id) => store[id]);
+  if (ids.length === 0) {
+    throw new Error(
+      "No registrar connected. Run: uplink domains providers connect godaddy --token-env GODADDY_PAT --json"
+    );
+  }
+
+  let lastError: string | undefined;
+  for (const id of ids) {
+    const creds = store[id];
+    if (!creds) throw new Error(`${id} is not connected`);
+    try {
+      return await getAdapter(id).check(creds, domain);
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  return {
+    domain,
+    provider: ids[0],
+    status: "unknown",
+    error: lastError || "check failed",
+  };
+}
+
+export const domainsCommand = new Command("domains").description(
+  "Registrar inventory, availability, and search. Attach with `uplink host domains`."
+);
+
+domainsCommand.addHelpText(
+  "after",
+  "\nWith no subcommand, opens the domain search TUI.\n"
+);
+
+domainsCommand.action(() => {
+  const message = launchDomainking();
+  if (message) console.log(message);
+});
+
+domainsCommand
+  .command("list")
+  .description("List domains owned at connected registrars")
+  .option("--provider <id>", "Only this provider (godaddy|cloudflare|hostinger|namecheap|dreamhost)")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const provider = parseProvider(opts.provider);
+      const domains = await listInventory(provider);
+      if (opts.json) {
+        printJson({ domains, count: domains.length });
+        return;
+      }
+      if (domains.length === 0) {
+        console.log("No domains. Connect a registrar: uplink domains providers connect godaddy");
+        return;
+      }
+      for (const item of domains) {
+        const expiry = item.expiresAt ? `  expires ${item.expiresAt}` : "";
+        console.log(`- ${item.domain} (${item.provider}${expiry})`);
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+domainsCommand
+  .command("check")
+  .description("Check domain availability (public DNS/RDAP; connected registrars add price)")
+  .argument("<domain>", "Domain name (e.g. example.com)")
+  .option("--provider <id>", "Which registrar to ask")
+  .option("--json", "Output JSON", false)
+  .action(async (domainArg: string, opts) => {
+    try {
+      const domain = String(domainArg).trim().toLowerCase();
+      if (!domain.includes(".")) throw new Error("Pass a full domain like example.com");
+      const provider = parseProvider(opts.provider);
+
+      // No registrar connected: fall back to public DNS/RDAP availability.
+      const store = readRegistrarStore();
+      const hasRegistrar = provider ? Boolean(store[provider]) : CHECK_ORDER.some((id) => store[id]);
+      if (!hasRegistrar) {
+        const result = await checkDomainAvailability(domain);
+        if (opts.json) {
+          printJson({
+            domain: result.domain,
+            provider: "public",
+            status: result.status,
+            buyable: null,
+            detail: result.detail,
+            note: "Connect a registrar for price and purchase info.",
+          });
+          return;
+        }
+        console.log(formatPublicAvailability(result));
+        return;
+      }
+
+      const quote = await quoteDomain(domain, provider);
+      if (opts.json) {
+        printJson(quote);
+        return;
+      }
+      const price = quote.priceUsd != null ? `  $${quote.priceUsd.toFixed(2)}/yr` : "";
+      const premium = quote.premium ? " premium" : "";
+      console.log(`${quote.domain}  ${quote.status}${price}${premium}  [${quote.provider}]`);
+      if (quote.error) console.log(`  ${quote.error}`);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+const providers = domainsCommand.command("providers").description("Connect registrar accounts");
+
+providers
+  .command("list")
+  .description("Show which registrars are connected (never prints secrets)")
+  .option("--json", "Output JSON", false)
+  .action((opts) => {
+    try {
+      const store = readRegistrarStore();
+      const items = adapters.map((adapter) => ({
+        id: adapter.id,
+        label: adapter.label,
+        connected: Boolean(store[adapter.id]),
+        help: adapter.connectHelp,
+      }));
+      if (opts.json) {
+        printJson({ providers: items });
+        return;
+      }
+      for (const item of items) {
+        console.log(`- ${item.id}  ${item.connected ? "connected" : "not connected"}`);
+        if (!item.connected) console.log(`    ${item.help}`);
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+providers
+  .command("connect")
+  .description("Save a registrar credential after a live check")
+  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap | dreamhost")
+  .option("--token-env <name>", "Env var holding the API token (comma-separate names for multiple keys)")
+  .option("--user-env <name>", "Env var holding the Namecheap API user")
+  .option("--account-env <name>", "Env var holding a Cloudflare account id (optional)")
+  .option("--json", "Output JSON", false)
+  .action(async (providerArg: string, opts) => {
+    try {
+      const provider = String(providerArg).toLowerCase();
+      if (!isProviderId(provider)) {
+        throw new Error(`Unknown provider: ${providerArg}. Use godaddy, cloudflare, hostinger, namecheap, or dreamhost`);
+      }
+      const adapter = getAdapter(provider);
+      const creds = await credentialsFromFlags(provider, opts);
+      const verified = await adapter.verify(creds);
+      saveProvider(provider, verified);
+      const listed = await adapter.listDomains(verified).catch(() => [] as InventoryDomain[]);
+      if (opts.json) {
+        printJson({
+          provider,
+          connected: true,
+          domains: listed.length,
+        });
+        return;
+      }
+      console.log(`Connected ${adapter.label} (${listed.length} domain${listed.length === 1 ? "" : "s"})`);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+providers
+  .command("disconnect")
+  .description("Remove a saved registrar credential")
+  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap | dreamhost")
+  .option("--json", "Output JSON", false)
+  .action((providerArg: string, opts) => {
+    try {
+      const provider = String(providerArg).toLowerCase();
+      if (!isProviderId(provider)) throw new Error(`Unknown provider: ${providerArg}`);
+      const removed = removeProvider(provider);
+      if (opts.json) {
+        printJson({ provider, connected: false, removed });
+        return;
+      }
+      console.log(removed ? `Disconnected ${provider}` : `${provider} was not connected`);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });

package/cli/src/subcommands/host-domains.ts

@@ -0,0 +1,148 @@
+import { Command } from "commander";
+import { apiRequest } from "../http";
+import { handleError, printJson } from "../utils/machine";
+
+type AppDomain = {
+  id: string;
+  hostname: string;
+  verified: boolean;
+  verifiedAt: string | null;
+  createdAt: string;
+  dns?: { type: string; host: string; target: string };
+};
+type AppDomainList = { domains: AppDomain[] };
+
+async function findDomainByHostname(appId: string, hostname: string): Promise<AppDomain | null> {
+  const result = (await apiRequest("GET", `/v1/apps/${appId}/domains`)) as AppDomainList;
+  const clean = hostname.trim().toLowerCase();
+  return result.domains?.find((d) => d.hostname === clean) ?? null;
+}
+
+function printDomain(domain: AppDomain): void {
+  const status = domain.verified ? "verified" : "pending verification";
+  console.log(`- ${domain.hostname} (${status})`);
+  if (domain.dns) {
+    console.log(`  DNS needed: ${domain.dns.type} ${domain.dns.host} -> ${domain.dns.target}`);
+  }
+}
+
+/** The verify endpoint responds 409 with a reason while DNS doesn't point at the edge. */
+function extractVerifyFailure(error: unknown): { reason?: string; dns?: AppDomain["dns"] } | null {
+  if (!(error instanceof Error)) return null;
+  try {
+    const parsed = JSON.parse(error.message) as { reason?: string; dns?: AppDomain["dns"] };
+    return parsed && (parsed.reason || parsed.dns) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+export const domainsCommand = new Command("domains").description(
+  "Manage custom domains for hosted apps"
+);
+
+domainsCommand
+  .command("list")
+  .description("List custom domains attached to an app")
+  .requiredOption("--id <id>", "App id (app_...)")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const result = (await apiRequest("GET", `/v1/apps/${opts.id}/domains`)) as AppDomainList;
+      if (opts.json) {
+        printJson(result);
+        return;
+      }
+      if (!result.domains || result.domains.length === 0) {
+        console.log("No custom domains attached.");
+        return;
+      }
+      console.log("Custom domains:");
+      for (const domain of result.domains) printDomain(domain);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+domainsCommand
+  .command("add")
+  .description("Attach a custom domain to an app")
+  .requiredOption("--id <id>", "App id (app_...)")
+  .requiredOption("--hostname <hostname>", "Domain to attach (e.g. example.com)")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const domain = (await apiRequest("POST", `/v1/apps/${opts.id}/domains`, {
+        hostname: opts.hostname,
+      })) as AppDomain;
+      if (opts.json) {
+        printJson(domain);
+        return;
+      }
+      console.log(`Attached ${domain.hostname} (pending verification)`);
+      if (domain.dns) {
+        console.log(`  1. At your registrar: ${domain.dns.type} ${domain.dns.host} -> ${domain.dns.target}`);
+      }
+      console.log(`  2. Then run: uplink host domains verify --id ${opts.id} --hostname ${domain.hostname}`);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+domainsCommand
+  .command("verify")
+  .description("Verify a domain's DNS points at the hosting edge (enables routing + TLS)")
+  .requiredOption("--id <id>", "App id (app_...)")
+  .requiredOption("--hostname <hostname>", "Domain to verify")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const domain = await findDomainByHostname(opts.id, opts.hostname);
+      if (!domain) throw new Error(`Domain ${opts.hostname} is not attached to app ${opts.id}`);
+
+      try {
+        const verified = (await apiRequest(
+          "POST",
+          `/v1/apps/${opts.id}/domains/${domain.id}/verify`
+        )) as AppDomain;
+        if (opts.json) printJson(verified);
+        else {
+          console.log(`Verified ${verified.hostname}`);
+          console.log(`  Live at https://${verified.hostname} (cert issues on first request)`);
+        }
+      } catch (error) {
+        const failure = extractVerifyFailure(error);
+        if (!failure) throw error;
+        if (opts.json) {
+          printJson({ hostname: domain.hostname, verified: false, ...failure });
+          return;
+        }
+        console.log(`Not verified yet: ${failure.reason || "DNS does not point at the edge"}`);
+        if (failure.dns) {
+          console.log(`  DNS needed: ${failure.dns.type} ${failure.dns.host} -> ${failure.dns.target}`);
+        }
+        console.log("  DNS changes can take a few minutes to propagate; try again shortly.");
+        process.exitCode = 1;
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+domainsCommand
+  .command("remove")
+  .description("Detach a custom domain from an app")
+  .requiredOption("--id <id>", "App id (app_...)")
+  .requiredOption("--hostname <hostname>", "Domain to detach")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const domain = await findDomainByHostname(opts.id, opts.hostname);
+      if (!domain) throw new Error(`Domain ${opts.hostname} is not attached to app ${opts.id}`);
+      const result = await apiRequest("DELETE", `/v1/apps/${opts.id}/domains/${domain.id}`);
+      if (opts.json) printJson(result);
+      else console.log(`Detached ${opts.hostname}`);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });

package/cli/src/subcommands/host.ts

@@ -13,6 +13,7 @@ import os from "os";
 import fetch from "node-fetch";
 import { spawnSync } from "child_process";
 import { getResolvedApiBase, getResolvedApiToken } from "../utils/api-base";
+import { domainsCommand } from "./host-domains";
 
 type App = { id: string; name: string; url: string; createdAt?: string; updatedAt?: string };
 type AppList = { apps: App[]; count: number };
@@ -591,6 +592,8 @@ function writeUplinkIgnore(dir: string, entries: string[]): void {
 
 export const hostCommand = new Command("host").description("Host persistent web services (Dockerfile required)");
 
+hostCommand.addCommand(domainsCommand);
+
 async function resolveSqliteConfig(
   analysis: AnalysisResult,
   opts: { yes: boolean }

package/cli/src/subcommands/login.ts

@@ -0,0 +1,85 @@
+import { Command } from "commander";
+import { createInterface } from "readline";
+import { handleError, printJson } from "../utils/machine";
+import { formatTokenForEnv, getResolvedApiBase } from "../utils/api-base";
+import { isEmail, normalizeEmail, persistLogin, requestLoginCode, verifyLoginCode } from "../utils/login-flow";
+
+function prompt(question: string): Promise<string> {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+
+export const loginCommand = new Command("login")
+  .description("Continue with email to unlock persistent features")
+  .option("--email <email>", "Email to send the login code to")
+  .option("--code <code>", "6-digit code from email (completes login)")
+  .option("--no-save", "Do not write ~/.uplink/credentials")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const json = Boolean(opts.json);
+      let email = opts.email ? normalizeEmail(opts.email) : "";
+      if (!email) {
+        if (json) {
+          console.error("Provide --email. To finish login, also pass --code.");
+          process.exit(2);
+        }
+        email = normalizeEmail(await prompt("Email: "));
+      }
+      if (!isEmail(email)) {
+        console.error("Invalid email.");
+        process.exit(2);
+      }
+
+      const codeOpt = opts.code ? String(opts.code).trim() : "";
+
+      if (!codeOpt) {
+        await requestLoginCode(email);
+        if (json) {
+          printJson({ ok: true, email, message: "OTP sent. Run again with --email and --code." });
+          return;
+        }
+        console.log(`Code sent to ${email}.`);
+        opts.code = (await prompt("Code: ")).trim();
+      }
+
+      const code = String(opts.code || "").trim();
+      if (!/^\d{6}$/.test(code)) {
+        console.error("Code must be 6 digits.");
+        process.exit(2);
+      }
+
+      const result = await verifyLoginCode(email, code);
+      const apiBase = getResolvedApiBase();
+      const save = opts.save !== false;
+      let savedTo: string | null = null;
+      if (save) {
+        savedTo = persistLogin(result, email);
+      }
+
+      if (json) {
+        printJson({ ...result, email, savedTo });
+        return;
+      }
+
+      const tokenExport = formatTokenForEnv(result.token, apiBase);
+      console.log("Logged in.");
+      console.log("");
+      console.log(`  Email:    ${email}`);
+      console.log(`  User ID:  ${result.userId}`);
+      console.log(`  Token:    ${result.token}`);
+      if (savedTo) console.log(`  Saved:    ${savedTo}`);
+      console.log("");
+      if (!savedTo) {
+        console.log("To use this token:");
+        console.log(`  export AGENTCLOUD_TOKEN="${tokenExport}"`);
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });

package/cli/src/subcommands/menu/colors.ts

@@ -67,5 +67,5 @@ export function colorSoftGray(text: string) {
 }
 
 export function colorAccent(text: string) {
-  return `${c.brightBlue}${text}${c.reset}`;
+  return `${c.bold}${c.brightWhite}${text}${c.reset}`;
 }

package/cli/src/subcommands/menu/effects/tunnel-clients.ts

@@ -1,8 +1,44 @@
 import { execSync, spawn } from "child_process";
+import { existsSync } from "fs";
+import path from "path";
 import { resolveProjectRoot } from "../../../utils/project-root";
 
 export type TunnelClient = { pid: number; port: number; token: string };
 
+export function resolveTunnelClientPath(): string {
+  const projectRoot = resolveProjectRoot(__dirname);
+  const clientPath = path.join(projectRoot, "scripts/tunnel/client-improved.js");
+  if (!existsSync(clientPath)) {
+    throw new Error(`Tunnel client not found at ${clientPath}`);
+  }
+  return clientPath;
+}
+
+/** Start the local tunnel client in the background (detached). */
+export function startTunnelClient(opts: {
+  token: string;
+  port: number;
+  ctrl?: string;
+}): { pid: number; clientPath: string } {
+  const projectRoot = resolveProjectRoot(__dirname);
+  const clientPath = resolveTunnelClientPath();
+  const ctrl = opts.ctrl || process.env.TUNNEL_CTRL || "tunnel.uplink.spot:7071";
+  const clientProcess = spawn(
+    "node",
+    [clientPath, "--token", opts.token, "--port", String(opts.port), "--ctrl", ctrl],
+    {
+      stdio: "ignore",
+      detached: true,
+      cwd: projectRoot,
+    }
+  );
+  clientProcess.unref();
+  if (!clientProcess.pid) {
+    throw new Error("Failed to start tunnel client process");
+  }
+  return { pid: clientProcess.pid, clientPath };
+}
+
 export function findTunnelClients(): TunnelClient[] {
   try {
     // Find processes running client-improved.js (current user, match script path to avoid false positives)
@@ -39,11 +75,23 @@ export function findTunnelClients(): TunnelClient[] {
 
 export function killTunnelClient(pid: number): boolean {
   try {
-    execSync(`kill -TERM ${pid}`, { stdio: "ignore" });
-    return true;
+    process.kill(pid, "SIGTERM");
   } catch {
     return false;
   }
+  try {
+    execSync(`kill -0 ${pid} && sleep 0.4 && kill -KILL ${pid} || true`, {
+      stdio: "ignore",
+    });
+  } catch {
+    /* process already gone */
+  }
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch {
+    return true;
+  }
 }
 
 export function killAllTunnelClients(clients: TunnelClient[]): number {
@@ -54,8 +102,44 @@ export function killAllTunnelClients(clients: TunnelClient[]): number {
   return killed;
 }
 
+type ApiTunnel = { id?: string; token?: string; connected?: boolean };
+
 type ApiRequest = (method: string, path: string, body?: unknown) => Promise<any>;
 
+export async function stopTunnelClients(
+  apiRequest: ApiRequest,
+  clients: TunnelClient[],
+  opts: { connectedGhosts?: boolean } = {}
+): Promise<{ killed: number; deleted: number }> {
+  const tokens = new Set(clients.map((c) => c.token));
+  let deleted = 0;
+
+  try {
+    const result = await apiRequest("GET", "/v1/tunnels");
+    const tunnels = (result.tunnels || []) as ApiTunnel[];
+    for (const tunnel of tunnels) {
+      if (!tunnel.id) continue;
+      const matched = Boolean(tunnel.token && tokens.has(tunnel.token));
+      const ghost = Boolean(opts.connectedGhosts && tunnel.connected);
+      if (!matched && !ghost) continue;
+      try {
+        await apiRequest("DELETE", `/v1/tunnels/${tunnel.id}`);
+        deleted++;
+      } catch {
+        /* keep stopping the rest */
+      }
+    }
+  } catch {
+    /* still kill local processes */
+  }
+
+  let killed = 0;
+  for (const c of clients) {
+    if (killTunnelClient(c.pid)) killed++;
+  }
+  return { killed, deleted };
+}
+
 /**
  * Create a tunnel via API and start the local client in background.
  * NOTE: Maintains existing behavior including the brief post-spawn delay.
@@ -79,19 +163,8 @@ export async function createAndStartTunnel(apiRequest: ApiRequest, port: number)
   const url = result.url || "(no url)";
   const token = result.token || "(no token)";
   const alias = result.alias || null;
-  const ctrl = process.env.TUNNEL_CTRL || "tunnel.uplink.spot:7071";
 
-  // Start tunnel client in background
-  // (CommonJS build: __dirname available)
-  const path = require("path");
-  const projectRoot = resolveProjectRoot(__dirname);
-  const clientPath = path.join(projectRoot, "scripts/tunnel/client-improved.js");
-  const clientProcess = spawn("node", [clientPath, "--token", token, "--port", String(port), "--ctrl", ctrl], {
-    stdio: "ignore",
-    detached: true,
-    cwd: projectRoot,
-  });
-  clientProcess.unref();
+  startTunnelClient({ token, port });
 
   // Wait a moment for client to connect
   await new Promise((resolve) => setTimeout(resolve, 2000));