Author

Rachel Chen <rachel@chens.email> 2026-09-12 06:12:28 -0700

Parents

e5a5d7b

Tree

26d4a33

tun: add ephemeral and token-delegated tunnels

Add apex-only expose and token-authorized serve commands, plus owner grant
management through the CLI and local API. Bind each session to its active
connection and revalidate delegated sessions independently, with expiry that
closes streams even during stalled storage reads.

Discover up to three token attachment servers through GetNodes and publish each
connection in its assigned route slot. Reuse the client forwarder and reconnect
scheduler, keep Open methods on TunnelService, and preserve routing for older
gateways. Include RPC bindings, lifecycle tests, integrations, and a reproducible
binary compatibility test.