Add local-port and public-tunnel reachability checks

2026-10-30 22:42:40 +08:00
parent baff9449bd
commit 5f98c2834f
6 changed files with 411 additions and 8 deletions
@@ -199,7 +199,9 @@ what we take vs. skip). Never vendor it into the build.
  update both tap files' URLs/SHAs on each release. The app has
  **Connect on launch** (`auto_connect`); add it to macOS Login Items to
  reconnect at login. The CLI `tunnel up` remains a detached process; the
-  desktop app runs the service in-process.
+  desktop app runs the service in-process. `tunnel check [route]` and the
+  desktop **Check now** button check the local TCP target plus a public TLS
+  handshake (DNS, proxy, bridge, certificate); public checks use a 5s deadline.
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
  M3 rate limits/admin/hardening (done); M4 Go client (done); M5 desktop app
  (done). Remaining optional work: launchd/systemd agents for the Go client,