Add hosted captun.sh safety controls

[mmkal]

Summary

Adds the first public-hosted safety layer for the now-merged hosted captun.sh gateway.

Hosted captun.sh tunnels now get a generated captun-token; the active tunnel keeps that token, same-token reconnects can replace it, and different-token reconnects get 409 instead of evicting someone else. Forwarded responses also drop Set-Cookie headers whose Domain escapes the active tunnel hostname while captun.sh waits for enough usage to justify Public Suffix List submission.

const tunnel = await createCaptunTunnel({
  fetch: (request) => new Response("ok"),
});

console.log(tunnel.url);   // https://<random>.captun.sh
console.log(tunnel.token); // generated hosted reconnect token

Structure

• src/worker.ts owns the shared Cloudflare Tunnel Gateway and CaptunServerShard tunnel lifecycle; its default decideTunnelAdmission behavior keeps self-hosted deployments trusted and token-gated only when CAPTUN_TOKEN is set.
• src/hosted/worker.ts is the Iterate-operated hosted gateway entrypoint for captun.sh; it subclasses the shared shard to override public hosted admission, wraps requests with hosted rate limits, and strips broad response cookie domains.
• src/hosted/rate-limit.ts owns hosted-only Durable Object rate-limit buckets.
• src/hosted/site.ts owns the www.captun.sh docs/demo surface and browser module.

Notes for reviewers

• Self-hosted deployments without CAPTUN_TOKEN keep trusted replacement behavior; deployments with CAPTUN_TOKEN still require the configured token.
• The hosted Wrangler config is the only deployment config with the HostedRateLimiter binding.
• The browser demo module now generates the same hosted token as the package and CLI.
• WebSocket connection failures do a short diagnostic HTTP probe so CLI errors can show 409/429 bodies instead of generic WebSocket failures.
• Hosted response hardening keeps host-only cookies and cookies scoped to the active tunnel hostname, but strips Domain=captun.sh, sibling tunnel domains, and other domains outside that tunnel namespace.

Verification

• pnpm exec vitest run test/hosted-worker.test.ts
• pnpm run check
• pnpm test

---

Note

High Risk
Changes public tunnel admission, rate limiting, and cookie handling on the untrusted hosted gateway—security-sensitive paths with broad test coverage but production impact on all captun.sh users.

Overview
This PR adds the first public hosted safety layer for captun.sh, keeping public gateway policy in src/hosted/ while src/worker.ts stays the shared self-hosted gateway core.

Tunnel ownership: Hosted clients (CLI, library, browser demo) now get a generated captun-token when targeting captun.sh. The hosted shard overrides admission so anonymous connects require that token, same-token reconnects can replace the session, and a different token gets 409 instead of evicting the active tunnel. Self-hosted behavior is unchanged unless CAPTUN_TOKEN is set.

Rate limiting: New HostedRateLimiter Durable Object buckets throttle connect attempts and forwarded traffic per cf-connecting-ip and per tunnel name, with a diagnostic path that does not open WebSockets or replace active tunnels. Missing the limiter binding returns 503 unless explicitly disabled.

Client UX: createCaptunTunnel probes failed WebSocket upgrades via x-captun-connect-diagnostic and surfaces CaptunTunnelConnectError with HTTP status/body; the CLI skips DNS hints for the known name-conflict case and reuses the same hosted token across retries.

Response hardening: Hosted forwards strip Set-Cookie headers whose Domain escapes the active tunnel hostname (e.g. apex or sibling subdomains).

^{Reviewed by Cursor Bugbot for commit 133ffbf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/captun@22

commit: 133ffbf

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d41f629. Configure here.}