fix(tunnel): warn before invalidating active quick tunnel URL - #424

Merged
OisinKyne merged 1 commit into
mainfrom
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged

fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom
fix/tunnel-warn-quick-url-loss

Conversation

@bussyjd

@bussyjdbussyjd commented May 5, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.

Surfaced in the rc8 reviewer feedback (item #4):

Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.

Approach

  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.

Behavior

ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt

Sample output (interactive):

==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan

  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  • New unit tests in tunnel_lifecycle_test.go:
    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  • Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL
    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  • Manual: obol tunnel restart on a quick tunnel shows the warning
    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  • Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)
    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  • Manual: piping obol stack down < /dev/null does not block
    • Verified on spark2; command completed and tore down the stack without hanging

Out of scope

  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.

@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne merged commit 34b83e1 into mainMay 5, 2026
6 checks passed
@OisinKyne
OisinKyne deleted the fix/tunnel-warn-quick-url-loss branch May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(tunnel): warn before invalidating active quick tunnel URL - #424
Merged
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
May 5, 2026
Merged
fix(tunnel): warn before invalidating active quick tunnel URL#424
OisinKyne merged 1 commit into
mainfrom 
fix/tunnel-warn-quick-url-loss
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 5, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
obol stack down and obol tunnel restart both rotate the *.trycloudflare.com URL on quick tunnels (cluster delete kills the cloudflared pod; rollout restart starts a fresh one). Until now there was no warning before the rotation, so anyone with a seller registered against the URL would silently 530 after an RC upgrade or restart cycle.
Surfaced in the rc8 reviewer feedback (item #4):
Quick-tunnel *.trycloudflare.com URLs are ephemeral and the cloudflared deployment is recreated during obol stack up. Our pre-upgrade URL result-tactics-nyc-pittsburgh.trycloudflare.com died and was replaced by hospital-binding-centered-fact.trycloudflare.com. […] anyone who previously bookmarked the old URL is now seeing 530s.
Approach
  • New ConfirmQuickTunnelLoss(cfg, u, currentURL, action) in internal/tunnel. Skips when loadTunnelState shows a persistent DNS tunnel (URL is stable across cluster recreates) or when no active quick tunnel URL is captured. Otherwise warns and prompts.
  • Wired into stack.Down() before the cluster-delete path, and into tunnel.Restart() before the rollout-restart.
  • Non-interactive sessions (CI, JSON output, no TTY) print the warning but pass through the default (yes), so automation is unaffected.
  • Drive-by gofmt of unrelated indentation drift in CreateStorefront that the formatter caught while editing the same file.
Behavior
ScenarioResult
Persistent (DNS) tunnel configuredNo warning, proceed
No active quick tunnel podNo warning, proceed (best-effort)
Active quick tunnel + interactive TTYWarn + Continue? [Y/n] (Enter = yes)
Active quick tunnel + non-interactiveWarning printed, proceed without prompt
Sample output (interactive):
==> Stopping the Obol Stack
! Quick tunnel URL will be invalidated: https://hospital-binding-centered-fact.trycloudflare.com
After `obol stack down`, the next `obol sell http` brings up a fresh URL.
Buyers using the old URL will see 530 errors.
For a permanent URL: obol tunnel login --hostname stack.example.com
Continue? [Y/n]

Test plan
  • go build ./... clean
  • go test ./internal/tunnel/ ./internal/stack/ pass
  •  New unit tests in tunnel_lifecycle_test.go:

    • TestConfirmQuickTunnelLoss_PersistentSkipsWarning — DNS state set, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_EmptyURLSkips — no captured URL, helper short-circuits to true
    • TestConfirmQuickTunnelLoss_NonInteractivePassesThrough — warning printed, default-yes pass-through
  •  Manual: obol stack up → obol sell http demo → obol stack down shows the warning with the active quick URL

    • Verified on spark2; warning printed with active quick tunnel URL https://surrounded-lucia-gulf-rapids.trycloudflare.com
  •  Manual: obol tunnel restart on a quick tunnel shows the warning

    • Verified on spark2; restart warned before rotating the active quick-tunnel URL
  •  Manual: obol tunnel login --hostname … followed by obol stack down shows no warning (persistent path)

    • Verified on spark1; obol tunnel login --hostname pr424-20260505163420-spark1.humanresearch.ai completed, and subsequent obol stack down completed without the quick-tunnel invalidation warning
  •  Manual: piping obol stack down < /dev/null does not block

    • Verified on spark2; command completed and tore down the stack without hanging
Out of scope
  • The reviewer's alternative suggestion ("skip recreating the cloudflared deployment if values are unchanged") would require the cluster to survive across upgrades, which is a much larger architectural shift. This PR addresses only the user-facing surprise.
  • No on-chain re-registration on URL rotation — the existing tunnel.Restart / SyncAgentBaseURL / SyncTunnelConfigMap path already updates /skill.md and agent metadata to the new URL.
@bussyjd
fix(tunnel): warn before invalidating active quick tunnel URL
2578c75
`obol stack down` and `obol tunnel restart` both rotate the
*.trycloudflare.com URL on quick tunnels. Previously users got no
warning before the rotation, so buyers using the old URL would silently
see 530 errors after an RC upgrade or restart cycle.
Add `ConfirmQuickTunnelLoss` in internal/tunnel that prints the
soon-to-be-stale URL and offers a confirmation prompt. Skips entirely
for persistent DNS tunnels (URL is stable across these events) and when
no active quick tunnel pod is captured. Non-interactive sessions print
the warning but pass through the default (yes), preserving automation
and CI behavior.
Wired into `stack.Down` (pre-cluster-delete) and `tunnel.Restart`
(pre-rollout-restart). Drive-by gofmt of unrelated indentation drift in
`CreateStorefront`.
@OisinKyne
OisinKyne
merged commit 34b83e1
into
mainMay 5, 2026

6 checks passed

@OisinKyne
OisinKyne
deleted the

fix/tunnel-warn-quick-url-loss

branch
May 5, 2026 11:28
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneOisinKyne approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@bussyjd@OisinKyne