uplink-cli 0.1.38 → 0.2.0

package/cli/src/subcommands/signup.ts

@@ -39,7 +39,7 @@ async function signupRequest(body: Record<string, unknown>): Promise<SignupRespo
 }
 
 export const signupCommand = new Command("signup")
-  .description("Create a new user account and token (no auth required)")
+  .description("Create an explicit guest token (tunnel create does this automatically)")
   .option("--label <label>", "Optional label for the token")
   .option("--expires-days <days>", "Token expiration in days (optional)")
   .option("--json", "Output JSON", false)
@@ -63,7 +63,7 @@ export const signupCommand = new Command("signup")
       } else {
         const apiBase = getResolvedApiBase();
         const tokenExport = formatTokenForEnv(result.token, apiBase);
-        console.log("Account created successfully!");
+        console.log("Guest access created successfully!");
         console.log("");
         console.log(`  Token:    ${result.token}`);
         console.log(`  User ID:  ${result.userId}`);

package/cli/src/subcommands/system.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { apiRequest } from "../http";
+import { handleError, printJson } from "../utils/machine";
 
 type SystemStatus = {
   hasInternalSecret: boolean;
@@ -25,50 +26,71 @@ export const systemCommand = new Command("system")
       .description("Show system status for relay/TLS wiring")
       .option("--json", "Output raw JSON")
       .action(async (opts) => {
-        const status = await fetchStatus();
-        if (opts.json) {
-          console.log(JSON.stringify(status, null, 2));
-          return;
-        }
+        try {
+          const status = await fetchStatus();
+          if (opts.json) {
+            printJson(status);
+            return;
+          }
 
-        console.log([
-          "System Status",
-          "-------------",
-          `Internal secret configured: ${formatBoolean(status.hasInternalSecret)}`,
-          `Relay reachable:            ${formatBoolean(status.relayReachable)}`,
-          `Relay connected tunnels:    ${status.relayConnectedCount}`,
-          `TLS mode:                   ${status.tlsMode}`,
-          `Wildcard domains:           ${status.wildcardDomains.join(", ")}`,
-          `Ask endpoint:               ${status.askEndpoint.path} (${status.askEndpoint.protected ? "protected" : "unprotected"})`,
-          status.askEndpoint.note ? `Note: ${status.askEndpoint.note}` : "",
-        ].filter(Boolean).join("\n"));
+          console.log(
+            [
+              "System Status",
+              "-------------",
+              `Internal secret configured: ${formatBoolean(status.hasInternalSecret)}`,
+              `Relay reachable:            ${formatBoolean(status.relayReachable)}`,
+              `Relay connected tunnels:    ${status.relayConnectedCount}`,
+              `TLS mode:                   ${status.tlsMode}`,
+              `Wildcard domains:           ${status.wildcardDomains.join(", ")}`,
+              `Ask endpoint:               ${status.askEndpoint.path} (${status.askEndpoint.protected ? "protected" : "unprotected"})`,
+              status.askEndpoint.note ? `Note: ${status.askEndpoint.note}` : "",
+            ]
+              .filter(Boolean)
+              .join("\n")
+          );
+        } catch (error) {
+          handleError(error, { json: opts.json });
+        }
       })
   )
   .addCommand(
     new Command("explain")
       .description("Explain missing/unsafe settings")
-      .action(async () => {
-        const status = await fetchStatus();
-        const issues: string[] = [];
+      .option("--json", "Output JSON", false)
+      .action(async (opts) => {
+        try {
+          const status = await fetchStatus();
+          const issues: string[] = [];
 
-        if (!status.hasInternalSecret) {
-          issues.push("- RELAY_INTERNAL_SECRET is missing. Set it for backend + relay to protect internal endpoints.");
-        }
-        if (!status.relayReachable) {
-          issues.push("- Relay unreachable via /internal/connected-tokens. Check relay service and secret header.");
-        }
-        if (status.askEndpoint && !status.askEndpoint.protected) {
-          issues.push("- Ask endpoint is not protected; ensure RELAY_INTERNAL_SECRET is set.");
-        }
+          if (!status.hasInternalSecret) {
+            issues.push(
+              "- RELAY_INTERNAL_SECRET is missing. Set it for backend + relay to protect internal endpoints."
+            );
+          }
+          if (!status.relayReachable) {
+            issues.push(
+              "- Relay unreachable via /internal/connected-tokens. Check relay service and secret header."
+            );
+          }
+          if (status.askEndpoint && !status.askEndpoint.protected) {
+            issues.push("- Ask endpoint is not protected; ensure RELAY_INTERNAL_SECRET is set.");
+          }
 
-        console.log("System Explain");
-        console.log("--------------");
-        if (issues.length === 0) {
-          console.log("No critical issues detected. TLS mode:", status.tlsMode);
-          return;
+          if (opts.json) {
+            printJson({ status, issues });
+            return;
+          }
+
+          console.log("System Explain");
+          console.log("--------------");
+          if (issues.length === 0) {
+            console.log("No critical issues detected. TLS mode:", status.tlsMode);
+            return;
+          }
+          console.log("Issues:");
+          issues.forEach((i) => console.log(i));
+        } catch (error) {
+          handleError(error, { json: opts.json });
         }
-        console.log("Issues:");
-        issues.forEach((i) => console.log(i));
       })
   );
-

package/cli/src/subcommands/tunnel.ts

@@ -1,6 +1,12 @@
 import { Command } from "commander";
 import { apiRequest } from "../http";
 import { handleError, printJson } from "../utils/machine";
+import {
+  findTunnelClients,
+  killTunnelClient,
+  startTunnelClient,
+} from "./menu/effects/tunnel-clients";
+import { ensureGuestAccess } from "../utils/guest-access";
 
 type TunnelResponse = {
   id: string;
@@ -9,10 +15,13 @@ type TunnelResponse = {
   port?: number;
   token?: string;
   alias?: string | null;
+  aliasUrl?: string | null;
   status?: string;
+  connected?: boolean;
   createdAt?: string;
   updatedAt?: string;
   ingressHttpUrl?: string;
+  targetPort?: number;
 };
 
 type TunnelListResponse = {
@@ -22,16 +31,18 @@ type TunnelListResponse = {
 
 type TunnelStatsResponse = any;
 
-export const tunnelCommand = new Command("tunnel")
-  .description("Manage tunnels non-interactively (agent-friendly)");
+export const tunnelCommand = new Command("tunnel").description(
+  "Manage tunnels non-interactively (agent-friendly)"
+);
 
-// Create tunnel
+// Create tunnel + start local client (unless --no-client)
 tunnelCommand
   .command("create")
-  .description("Create a tunnel")
+  .description("Create a tunnel and start the local client")
   .requiredOption("--port <port>", "Local port to expose")
   .option("--alias <alias>", "Optional permanent alias (if enabled on account)")
   .option("--project <project>", "Optional project id")
+  .option("--api-only", "Create API record only; do not start the local client", false)
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     const port = Number(opts.port);
@@ -41,42 +52,76 @@ tunnelCommand
     }
 
     try {
+      await ensureGuestAccess();
+      const existing = findTunnelClients().filter((c) => c.port === port);
+      if (existing.length > 0 && !opts.apiOnly) {
+        const err = `Tunnel client already running on port ${port} (pid ${existing[0].pid})`;
+        if (opts.json) {
+          printJson({ error: err, existing: existing[0] });
+        } else {
+          console.error(err);
+        }
+        process.exit(2);
+      }
+
       const body: Record<string, unknown> = { port };
       if (opts.project) body.project = opts.project;
 
-      const tunnel = await apiRequest("POST", "/v1/tunnels", body) as TunnelResponse;
+      const tunnel = (await apiRequest("POST", "/v1/tunnels", body)) as TunnelResponse;
       let aliasResult: TunnelResponse | null = null;
       let aliasError: string | null = null;
 
       if (opts.alias) {
         try {
-          aliasResult = await apiRequest("POST", `/v1/tunnels/${tunnel.id}/alias`, {
+          aliasResult = (await apiRequest("POST", `/v1/tunnels/${tunnel.id}/alias`, {
             alias: opts.alias,
-          }) as TunnelResponse;
+          })) as TunnelResponse;
         } catch (err: any) {
           aliasError = err?.message || String(err);
         }
       }
 
+      let client: { pid: number; started: boolean } | null = null;
+      if (!opts.apiOnly) {
+        const token = tunnel.token;
+        if (!token) {
+          throw new Error("Tunnel created but API returned no token; cannot start client");
+        }
+        const started = startTunnelClient({ token, port });
+        // Brief wait so list/connected is more likely accurate for agents.
+        await new Promise((resolve) => setTimeout(resolve, 1500));
+        client = { pid: started.pid, started: true };
+      }
+
+      const url =
+        aliasResult?.aliasUrl ||
+        aliasResult?.url ||
+        tunnel.url ||
+        tunnel.ingressHttpUrl ||
+        null;
+      const alias = aliasResult?.alias ?? tunnel.alias ?? null;
+
       if (opts.json) {
         printJson({
-          tunnel,
-          alias: aliasResult?.alias ?? null,
+          tunnel: {
+            ...tunnel,
+            alias,
+            aliasUrl: aliasResult?.aliasUrl ?? tunnel.aliasUrl ?? null,
+            url: tunnel.url ?? tunnel.ingressHttpUrl,
+          },
+          alias,
           aliasError,
+          url,
+          client,
         });
       } else {
         console.log(`Created tunnel ${tunnel.id}`);
-        console.log(`  url:   ${tunnel.url ?? tunnel.ingressHttpUrl ?? "-"}`);
-        console.log(`  token: ${tunnel.token ?? "-"}`);
-        if (opts.alias) {
-          if (aliasResult?.alias) {
-            console.log(`  alias: ${aliasResult.alias}`);
-          } else if (aliasError) {
-            console.log(`  alias: failed - ${aliasError}`);
-          }
-        } else if (tunnel.alias) {
-          console.log(`  alias: ${tunnel.alias}`);
-        }
+        console.log(`  url:    ${url ?? "-"}`);
+        console.log(`  token:  ${tunnel.token ?? "-"}`);
+        if (alias) console.log(`  alias:  ${alias}`);
+        else if (aliasError) console.log(`  alias:  failed - ${aliasError}`);
+        if (client) console.log(`  client: started (pid ${client.pid})`);
+        else console.log(`  client: not started (--api-only)`);
       }
     } catch (error) {
       handleError(error, { json: opts.json });
@@ -90,7 +135,7 @@ tunnelCommand
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
-      const result = await apiRequest("GET", "/v1/tunnels") as TunnelListResponse;
+      const result = (await apiRequest("GET", "/v1/tunnels")) as TunnelListResponse;
       if (opts.json) {
         printJson(result);
       } else {
@@ -100,8 +145,10 @@ tunnelCommand
         }
         console.log(`Tunnels (${result.count}):`);
         for (const t of result.tunnels) {
+          const connected = t.connected ? "connected" : "idle";
+          const token = t.token ? `${String(t.token).slice(0, 8)}…` : "-";
           console.log(
-            `${t.id}  ${t.url ?? t.ingressHttpUrl ?? "-"}  token=${t.token ?? "-"}  alias=${t.alias ?? "-"}  status=${t.status ?? "-"}`
+            `${t.id}  ${t.url ?? t.ingressHttpUrl ?? "-"}  token=${token}  alias=${t.alias ?? "-"}  status=${t.status ?? "-"}  ${connected}`
           );
         }
       }
@@ -119,9 +166,9 @@ tunnelCommand
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
-      const result = await apiRequest("POST", `/v1/tunnels/${opts.id}/alias`, {
+      const result = (await apiRequest("POST", `/v1/tunnels/${opts.id}/alias`, {
         alias: opts.alias,
-      }) as TunnelResponse;
+      })) as TunnelResponse;
       if (opts.json) {
         printJson(result);
       } else {
@@ -140,7 +187,10 @@ tunnelCommand
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
-      const result = await apiRequest("DELETE", `/v1/tunnels/${opts.id}/alias`) as TunnelResponse;
+      const result = (await apiRequest(
+        "DELETE",
+        `/v1/tunnels/${opts.id}/alias`
+      )) as TunnelResponse;
       if (opts.json) {
         printJson(result);
       } else {
@@ -159,7 +209,10 @@ tunnelCommand
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
-      const result = await apiRequest("GET", `/v1/tunnels/${opts.id}/stats`) as TunnelStatsResponse;
+      const result = (await apiRequest(
+        "GET",
+        `/v1/tunnels/${opts.id}/stats`
+      )) as TunnelStatsResponse;
       if (opts.json) {
         printJson(result);
       } else {
@@ -171,22 +224,62 @@ tunnelCommand
     }
   });
 
-// Stop (delete) tunnel
+// Stop (delete) tunnel and kill any matching local client
 tunnelCommand
   .command("stop")
-  .description("Stop (delete) a tunnel")
-  .requiredOption("--id <id>", "Tunnel id")
+  .description("Stop a tunnel: kill the local client and delete the record")
+  .option("--id <id>", "Tunnel id")
+  .option("--all", "Stop every tunnel for this account", false)
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
+    if (!opts.all && !opts.id) {
+      console.error("Provide --id or --all");
+      process.exit(2);
+    }
+
     try {
-      const result = await apiRequest("DELETE", `/v1/tunnels/${opts.id}`) as { id: string; status: string };
+      if (opts.all) {
+        const listed = (await apiRequest("GET", "/v1/tunnels")) as TunnelListResponse;
+        let killed = 0;
+        for (const client of findTunnelClients()) {
+          if (killTunnelClient(client.pid)) killed++;
+        }
+        let deleted = 0;
+        for (const t of listed.tunnels || []) {
+          if (!t.id) continue;
+          try {
+            await apiRequest("DELETE", `/v1/tunnels/${t.id}`);
+            deleted++;
+          } catch {
+            /* already gone */
+          }
+        }
+        if (opts.json) {
+          printJson({ ok: true, killed, deleted });
+        } else {
+          console.log(`Stopped ${killed} local client(s), removed ${deleted} tunnel record(s)`);
+        }
+        return;
+      }
+
+      const listed = (await apiRequest("GET", "/v1/tunnels")) as TunnelListResponse;
+      const target = (listed.tunnels || []).find((t) => t.id === opts.id);
+      if (target?.token) {
+        for (const client of findTunnelClients().filter((c) => c.token === target.token)) {
+          killTunnelClient(client.pid);
+        }
+      }
+
+      const result = (await apiRequest("DELETE", `/v1/tunnels/${opts.id}`)) as {
+        id: string;
+        status: string;
+      };
       if (opts.json) {
         printJson(result);
       } else {
         console.log(`Stopped tunnel ${result.id} (status=${result.status})`);
       }
-    } catch (error: any) {
-      console.error(error?.message || String(error));
-      process.exit(30);
+    } catch (error) {
+      handleError(error, { json: opts.json });
     }
   });

package/cli/src/templates/index.ts

@@ -154,7 +154,7 @@ RUN npm install -g serve
 COPY --from=builder /app/${distDir} ./public
 
 EXPOSE ${port}
-CMD ["sh", "-c", "serve -s public -l ${PORT}"]
+CMD ["sh", "-c", "serve -s public -l \${PORT}"]
 `;
   }
 
@@ -184,7 +184,7 @@ RUN npm install -g serve
 COPY --from=builder /app/${distDir} ./public
 
 EXPOSE ${port}
-CMD ["sh", "-c", "serve -s public -l ${PORT}"]
+CMD ["sh", "-c", "serve -s public -l \${PORT}"]
 `;
   }
 
@@ -215,7 +215,7 @@ RUN npm install -g serve
 COPY --from=builder /app/${distDir} ./public
 
 EXPOSE ${port}
-CMD ["sh", "-c", "serve -s public -l ${PORT}"]
+CMD ["sh", "-c", "serve -s public -l \${PORT}"]
 `;
 }
 

package/cli/src/tui/App.tsx

@@ -0,0 +1,202 @@
+import { Box, Text, useApp, useInput } from "ink";
+import { useState } from "react";
+import type { MenuChoice } from "../subcommands/menu/types";
+import { HomeStatus } from "./HomeStatus";
+import { AppInspector } from "./AppInspector";
+import { cleanLabel } from "./format";
+
+export type TunnelLine = { url: string; port: number };
+
+export type MenuStatus = {
+  connected: boolean;
+  latencyMs: number | null;
+  tunnels: TunnelLine[];
+  apps: { name: string; id: string; url?: string; createdAt?: string }[];
+  providers: string[];
+  storageUsedBytes: number;
+  storageLimitBytes: number;
+  appLimit: number;
+  alwaysOn: boolean;
+  idleMinutes: number | null;
+};
+
+export type MenuOutcome =
+  | { kind: "quit" }
+  | {
+      kind: "action";
+      action: () => Promise<string>;
+      isExit: boolean;
+      stack: MenuChoice[][];
+      titles: string[];
+      selected: number;
+    };
+
+function isDanger(label: string): boolean {
+  const lower = label.toLowerCase();
+  return lower.includes("stop all") || lower.includes("⚠") || lower.includes("delete");
+}
+
+function isExitLabel(label: string): boolean {
+  return label.toLowerCase() === "exit";
+}
+
+function noticeColor(line: string): string | undefined {
+  if (line.startsWith("Error:") || line.startsWith("✗")) return "red";
+  if (line.startsWith("✓")) return "green";
+  return undefined;
+}
+
+export function MenuApp({
+  tree,
+  status,
+  message,
+  initialStack,
+  initialTitles,
+  initialSelected,
+  onOutcome,
+}: {
+  tree: MenuChoice[];
+  status: MenuStatus;
+  message: string;
+  initialStack: MenuChoice[][];
+  initialTitles: string[];
+  initialSelected: number;
+  onOutcome: (outcome: MenuOutcome) => void;
+}) {
+  const { exit } = useApp();
+  const [stack, setStack] = useState<MenuChoice[][]>(initialStack);
+  const [titles, setTitles] = useState<string[]>(initialTitles);
+  const [selected, setSelected] = useState(initialSelected);
+  const [notice, setNotice] = useState(message);
+
+  const current = stack[stack.length - 1] ?? tree;
+  const atRoot = stack.length === 1;
+  const crumb = titles.slice(1).join(" › ");
+  const selectedChoice = current[selected];
+  const inspecting = Boolean(selectedChoice?.inspect);
+
+  const finish = (outcome: MenuOutcome) => {
+    onOutcome(outcome);
+    exit();
+  };
+
+  const goBack = () => {
+    if (notice) {
+      setNotice("");
+      return;
+    }
+    if (atRoot) {
+      finish({ kind: "quit" });
+      return;
+    }
+    setStack((prev) => prev.slice(0, -1));
+    setTitles((prev) => prev.slice(0, -1));
+    setSelected(0);
+  };
+
+  useInput((_input, key) => {
+    if (key.escape || key.leftArrow) {
+      goBack();
+      return;
+    }
+    if (_input === "q" && atRoot && !notice) {
+      finish({ kind: "quit" });
+      return;
+    }
+    if (key.upArrow) {
+      setSelected((i) => (i - 1 + current.length) % current.length);
+      return;
+    }
+    if (key.downArrow) {
+      setSelected((i) => (i + 1) % current.length);
+      return;
+    }
+    if (key.return) {
+      if (notice) {
+        setNotice("");
+        return;
+      }
+      const choice = current[selected];
+      if (!choice) return;
+      if (choice.subMenu && choice.subMenu.length > 0) {
+        setStack((prev) => [...prev, choice.subMenu!]);
+        setTitles((prev) => [...prev, cleanLabel(choice.label)]);
+        setSelected(0);
+        return;
+      }
+      if (choice.action) {
+        finish({
+          kind: "action",
+          action: choice.action,
+          isExit: isExitLabel(choice.label),
+          stack,
+          titles,
+          selected,
+        });
+      }
+    }
+  });
+
+  return (
+    <Box flexDirection="column" paddingX={1} paddingY={1}>
+      {atRoot ? (
+        <HomeStatus status={status} />
+      ) : (
+        <Box flexDirection="column">
+          <Text dimColor>UPLINK</Text>
+          {crumb ? (
+            <Box marginTop={1}>
+              <Text dimColor>{crumb}</Text>
+            </Box>
+          ) : null}
+        </Box>
+      )}
+
+      <Box flexDirection="column" marginTop={atRoot ? 1 : 1}>
+        {current.map((choice, i) => {
+          const active = i === selected;
+          const label = cleanLabel(choice.label);
+          const suffix = choice.subMenu ? " ›" : "";
+          const danger = isDanger(label);
+          const exitItem = isExitLabel(label);
+          return (
+            <Text
+              key={`${label}-${i}`}
+              bold={active && !exitItem}
+              color={active && danger ? "red" : undefined}
+              dimColor={!active || exitItem}
+            >
+              {active ? "› " : "  "}
+              {label}
+              {suffix}
+            </Text>
+          );
+        })}
+      </Box>
+
+      {inspecting ? <AppInspector inspect={selectedChoice?.inspect} /> : null}
+
+      {notice ? (
+        <Box flexDirection="column" marginTop={1}>
+          {notice.split("\n").map((line, i) => (
+            <Text key={i} color={noticeColor(line)} dimColor={!noticeColor(line)}>
+              {line || " "}
+            </Text>
+          ))}
+        </Box>
+      ) : null}
+
+      <Box marginTop={1}>
+        <Text dimColor>
+          {notice
+            ? "enter/esc dismiss"
+            : inspecting
+              ? "↑↓ inspect · ↵ open · esc back"
+              : atRoot
+                ? "↑↓ enter · esc/q quit"
+                : "↑↓ enter · esc back"}
+        </Text>
+      </Box>
+    </Box>
+  );
+}