fix(tunnel): make named-tunnel hostname changes take effect; use pnpm exec in release

Addresses both Codex review findings on PR #18 (verified before fixing):

1. Entering a new hostname for an already-configured named tunnel was
   silently ignored: named-create short-circuited on the existing config
   and cf-named.start() reads the YAML from disk, so the old hostname
   kept serving. named-create now reconfigures in place when the
   requested hostname differs — routes DNS to the existing tunnel uuid
   (new exported routeTunnelDns helper) and rewrites the managed YAML;
   same-hostname requests stay idempotent. The extension's tunnel:enable
   handler runs named-create as a pre-step whenever a cf-named hostname
   is supplied, aborting on real failures (e.g. DNS route rejected)
   instead of starting the tunnel on the previous hostname; setup-
   incomplete errors still fall through to the full setup wizard.

2. npx --no-install is not an install-prevention flag on npm 7+ —
   verified locally on npm 11 that a missing binary still hits the
   registry, which defeats the supply-chain pin in steps that hold
   publish tokens. Replaced with pnpm exec (verified to resolve the
   workspace-root pinned binaries from package subdirs and to fail
   closed when absent).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ARHAEEM

.github/workflows/release.yml

@@ -71,7 +71,7 @@ jobs:
           LOCAL=$(node -p "require('./$PKG').version")
 
           # Query VS Code Marketplace for the latest published version
-          PUBLISHED=$(npx --no-install vsce show Nskha.airtable-formula --json 2>/dev/null \
+          PUBLISHED=$(pnpm exec vsce show Nskha.airtable-formula --json 2>/dev/null \
             | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
                 try{console.log(JSON.parse(d).versions[0].version)}
                 catch{console.log('0.0.0')}
@@ -247,7 +247,7 @@ jobs:
 
           # Package
           cd packages/extension
-          npx --no-install vsce package --no-dependencies
+          pnpm exec vsce package --no-dependencies
           VSIX=$(ls *.vsix | head -1)
           echo "file=packages/extension/${VSIX}" >> $GITHUB_OUTPUT
           echo "Packaged: ${VSIX}"
@@ -257,7 +257,7 @@ jobs:
         if: |
           !inputs.dry_run &&
           (inputs.target == 'extension' || inputs.target == 'both')
-        run: npx --no-install vsce publish --packagePath "${{ steps.vsix.outputs.file }}"
+        run: pnpm exec vsce publish --packagePath "${{ steps.vsix.outputs.file }}"
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
 
@@ -266,7 +266,7 @@ jobs:
           !inputs.dry_run &&
           (inputs.target == 'extension' || inputs.target == 'both')
         run: |
-          npx --no-install ovsx publish "${{ steps.vsix.outputs.file }}" --pat "$OVSX_PAT"
+          pnpm exec ovsx publish "${{ steps.vsix.outputs.file }}" --pat "$OVSX_PAT"
 
           # Verify the version actually landed (Open VSX indexes asynchronously)
           VERSION="${{ steps.ext_version.outputs.next }}"

packages/extension/src/webview/DashboardProvider.ts

@@ -455,6 +455,38 @@ export class DashboardProvider implements vscode.WebviewViewProvider {
             authtoken = await this.context.secrets.get('airtable-formula.ngrok.authtoken') ?? undefined;
           }
         }
+
+        // cf-named with an explicit hostname: run named-create FIRST. The
+        // daemon's enable-tunnel starts from the on-disk YAML, so without
+        // this pre-step a changed hostname would be silently ignored and the
+        // old one kept serving. named-create is idempotent for the same
+        // hostname and reconfigures (route dns + YAML rewrite) for a new one.
+        if (msg.provider === 'cf-named' && msg.domain) {
+          try {
+            const createResp = await fetch(`http://127.0.0.1:${status.port}/daemon/tunnel/named-create`, {
+              method: 'POST',
+              headers: { Authorization: `Bearer ${status.bearerToken}`, 'Content-Type': 'application/json' },
+              body: JSON.stringify({ hostname: msg.domain }),
+              signal: AbortSignal.timeout(60_000),
+            });
+            if (!createResp.ok) {
+              const b = await createResp.json().catch(() => ({})) as Record<string, unknown>;
+              const createErr = typeof b.error === 'string' ? b.error : `HTTP ${createResp.status}`;
+              if (/not installed|login required|cert/i.test(createErr)) {
+                // First-time setup missing — fall through; enable-tunnel's
+                // error path routes into the full setup wizard below.
+              } else {
+                // Real failure (e.g. DNS route rejected). Abort rather than
+                // silently starting the tunnel on the previous hostname.
+                void vscode.window.showErrorMessage(`Tunnel hostname configuration failed: ${createErr}`);
+                this.postResult(msg.id, false, createErr);
+                await this.pushState();
+                return;
+              }
+            }
+          } catch { /* daemon unreachable — the enable call below surfaces it */ }
+        }
+
         const enableResp = await fetch(`http://127.0.0.1:${status.port}/daemon/enable-tunnel`, {
           method: 'POST',
           headers: {

packages/mcp-server/src/daemon/server.js

@@ -24,6 +24,7 @@ import {
   createNamedTunnel,
   writeTunnelConfig,
   readNamedTunnelConfig,
+  routeTunnelDns,
 } from './tunnel-providers/cloudflared-named-setup.js';
 import { getTunnelBinaryPath } from './install-tunnel.js';
 import { homedir } from 'node:os';
@@ -461,10 +462,26 @@ export async function startDaemonServer(options = {}) {
         return;
       }
 
-      // Idempotent: if already configured, just return existing config
+      // Idempotent for the SAME hostname; a DIFFERENT hostname reconfigures
+      // the existing tunnel in place (route dns + rewrite managed YAML) —
+      // same uuid and credentials, no new tunnel. Without this branch a new
+      // hostname was silently ignored and the old one kept serving.
       const existing = readNamedTunnelConfig(options.configDir);
       if (existing) {
-        res.json({ ok: true, uuid: existing.uuid, hostname: existing.hostname, configPath: existing.configPath, alreadyConfigured: true });
+        if (existing.hostname === hostname) {
+          res.json({ ok: true, uuid: existing.uuid, hostname: existing.hostname, configPath: existing.configPath, alreadyConfigured: true });
+          return;
+        }
+        const binaryPath = getTunnelBinaryPath(options.configDir);
+        await routeTunnelDns({ configDir: options.configDir, uuid: existing.uuid, hostname, binaryPath });
+        const rewritten = writeTunnelConfig({
+          configDir: options.configDir,
+          uuid: existing.uuid,
+          hostname,
+          port: getBoundPort(httpServer),
+          credentialsPath: existing.credentialsPath,
+        });
+        res.json({ ok: true, uuid: existing.uuid, hostname, configPath: rewritten.configPath, reconfigured: true });
         return;
       }
 

packages/mcp-server/src/daemon/tunnel-providers/cloudflared-named-setup.js

@@ -301,21 +301,55 @@ export async function createNamedTunnel(options) {
       return { uuid, name: parsedName || options.name, credentialsPath };
     })
     .then(async (tunnel) => {
-      const { code, stdout, stderr } = await runCapture(
-        spawnImpl,
+      await routeTunnelDns({
+        configDir: options.configDir,
+        uuid: tunnel.uuid,
+        hostname: options.hostname,
         binaryPath,
-        ['tunnel', 'route', 'dns', tunnel.uuid, options.hostname],
-        options.signal,
-      );
-      if (code !== 0) {
-        throw new Error(
-          `cloudflared route dns exited with code ${code}: ${stderr.trim() || stdout.trim()}`,
-        );
-      }
+        signal: options.signal,
+        dependencies: options.dependencies,
+      });
       return tunnel;
     });
 }
 
+/**
+ * Route an additional/replacement hostname to an EXISTING tunnel
+ * (`cloudflared tunnel route dns <uuid> <hostname>`). Used to reconfigure a
+ * named tunnel's hostname without creating a new tunnel — the uuid and
+ * credentials stay the same; only the DNS route (and our managed YAML,
+ * rewritten by the caller) change.
+ *
+ * @param {{
+ *   configDir?: string,
+ *   uuid: string,
+ *   hostname: string,
+ *   binaryPath?: string,
+ *   signal?: AbortSignal,
+ *   dependencies?: { spawn?: typeof nodeSpawn },
+ * }} options
+ * @returns {Promise<void>}
+ */
+export async function routeTunnelDns(options) {
+  if (!options.uuid) throw new Error('routeTunnelDns: uuid is required.');
+  if (!options.hostname) throw new Error('routeTunnelDns: hostname is required.');
+  const binaryPath = options.binaryPath ?? getTunnelBinaryPath(options.configDir);
+  assertBinaryExists(binaryPath);
+  const spawnImpl = options.dependencies?.spawn ?? nodeSpawn;
+
+  const { code, stdout, stderr } = await runCapture(
+    spawnImpl,
+    binaryPath,
+    ['tunnel', 'route', 'dns', options.uuid, options.hostname],
+    options.signal,
+  );
+  if (code !== 0) {
+    throw new Error(
+      `cloudflared route dns exited with code ${code}: ${stderr.trim() || stdout.trim()}`,
+    );
+  }
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // cloudflared tunnel delete
 // ─────────────────────────────────────────────────────────────────────