[snhsish]

Summary

Two workstreams in one branch:

1. BYO tunnel setup UX (\packages/crosscode)

• Logged-out \crosscode\ now asks how to connect instead of defaulting to cloudflared:
  \1. CrossCode Tunnel (recommended) 2. Cloudflared Named 3. Cloudflared Quick 4. Ngrok\ — each with live installed/not-found status, default 1.
• All tunnel configuration stays in the CLI (ngrok token prompt, \cloudflared tunnel login\ guidance + in-CLI polling, CrossCode login inline). Browser is only left for the unavoidable Cloudflare OAuth step.
• \Remember this tunnel choice so 'crosscode' starts instantly next time? [Y/n]\ is asked only after that tunnel's own setup succeeds (post-login/token/cert), saved globally as \ unnelPreference. Explicit flags (--ngrok, --cloudflared, --tunnel/--crosscode) bypass the prompt.
• Removed \l/\h\ keypress handling (\keypress.ts\ deleted) and its footer lines; no em-dashes in user-facing text.
• Pro upsell line shown when tier is free or a BYO tunnel is in use; all terminal email output masked (\j***@g***.com).
• Fixed Windows quick-tunnel args (--config /dev/null\ dropped) and ngrok polling stopping forever on an empty \ unnels[]\ response.

2. Tunnel-server robustness (\packages/tunnel-server, bumped to 0.2.4)

• Limit check no longer counts a reconnecting project's own stale entry, which caused false \�uth.fail 'plan allows N active tunnels'\ → silent cloudflared fallback while the app kept polling the dead URL.
• Entry exists but socket dead → immediate \502 TUNNEL_ENDPOINT_UNAVAILABLE\ instead of hanging the app.
• \503\ body now carries \code: TUNNEL_NOT_ACTIVE\ + \projectId\ (mobile reads .error, unaffected).
• Recently-closed SSE reqIds tracked (120s TTL) so late CLI chunks log at debug instead of warn-spam; single-deregister guard removes \deregister unknown project\ noise.

Diagnosis notes (from prod docker logs)

The live tunnel proxies fine (200s across /api/info, /global/health, /session, \POST /session). The \Tunnel not active\ lines are all stale project IDs polled by stored app connections (other project dir, pre-entropy 8-char IDs incl. another machine's, and the pre-switch \e816…\ URL). Remaining user-side issues are environmental: cloudflared binary missing on the test box, empty
grok.log\ (ngrok never served), and expired/insufficient-funds opencode provider keys. App-side stale-connection rebind is a mobile follow-up, not in this PR.

Test plan

• \pnpm --filter @crosscode/tunnel-server build\ + \pnpm --filter crosscode build\ pass; \ sc --noEmit\ clean for both.
• CLI: logged-out prompt flow for all 4 choices, remember Y/n persistence + skip on second run, flag bypass, maskEmail output, help text.
• Server: reconnect-during-stale-socket no longer trips the limit; dead-socket request gets 502; late chunks stay at debug.
• Needs VPS redeploy (\ unnel-server) for server fixes to take effect; single-CLI, same-cwd, rescan-after-fallback discipline when testing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
crosscode-web	Skipped		Oct 19, 2026 7:25am UTC