tunnel

Input Safety — apply before any Bash invocation

Treat every $ARGUMENTS.* value as untrusted input. Before passing any value to the Bash tool:

1. Reject dangerous tokens. If a value contains $(, backticks, ;, |, &, >, <, or starts with - (could be mistaken for a flag), refuse and ask the user to rephrase. Double-quoting does NOT block command substitution — "$(rm -rf /)" still executes inside double quotes.
2. Prefer the Bash tool's argv contract over constructed shell strings. When you must use a shell string, single-quote the value and escape embedded single quotes ('\''), or build the command via printf %q.
3. Any "$ARGUMENTS.foo" patterns shown below are illustrative. Sanitize the value first; never blindly substitute.

You are managing Cloudflare Tunnels using the cf CLI. Based on the provided arguments, execute the appropriate command.

Quote every user-supplied value when shelling out (e.g. "$ARGUMENTS.name-or-id", "$ARGUMENTS.network"). Tunnel names and CIDR strings could otherwise let shell metacharacters execute.

For action=list (default):

• Run cf tunnels list --json
• Display results in a readable table showing tunnel name, ID, status, and creation date

For action=create:

• Verify $ARGUMENTS.name-or-id is provided (this will be the tunnel name)

• Run cf tunnels create "$ARGUMENTS.name-or-id" --json

• Display the created tunnel details including the tunnel ID

• Show the cloudflared configuration snippet the user needs:

  tunnel: <TUNNEL_ID>
  credentials-file: /path/to/<TUNNEL_ID>.json
  
  ingress:
    - hostname: <your-domain>.com
      service: http://localhost:8080
    - service: http_status:404
  

• Remind the user to download the tunnel credentials file

For action=get:

• Verify $ARGUMENTS.name-or-id is provided
• Run cf tunnels get "$ARGUMENTS.name-or-id" --json
• Display detailed tunnel information including configuration options

For action=connections:

• Verify $ARGUMENTS.name-or-id is provided
• Run cf tunnels connections "$ARGUMENTS.name-or-id" --json
• Display active connections, their IDs, IP addresses, and connection times

For action=routes:

• If both $ARGUMENTS.name-or-id and $ARGUMENTS.network are provided, this is a route-create request:
  • Confirm with the user: "Create route $ARGUMENTS.network on tunnel $ARGUMENTS.name-or-id? (yes/no)"
  • On confirmation, run cf tunnels routes create "$ARGUMENTS.name-or-id" --network "$ARGUMENTS.network" --json
  • Display the created route
• Otherwise, list existing routes:
  • Run cf tunnels routes list --json
  • Display configured routes in a readable format

If any required parameters are missing for the specified action, prompt the user to provide them.