fix: restore CLI validation and test baseline (#1857)

Fixed lazy CLI helper imports for tunnel flows
Restored update command version detection
Made web test and dead-code commands run reliably

packages/web/bin/lib/cli-http.js

@@ -210,6 +210,7 @@ export {
   requestServerShutdown,
   requestJson,
   isServerHealthReady,
+  waitForServerHealth,
   fetchTunnelProvidersFromPort,
   fetchSystemInfoFromPort,
 };

packages/web/bin/lib/cli-network.js

@@ -145,6 +145,7 @@ export {
   resolveServeHost,
   resolveApiHost,
   formatHostForUrl,
+  isUnsafeBrowserPort,
   buildLocalUrl,
   detectLanIPv4Address,
   assertSafeBrowserPort,

packages/web/bin/lib/cli-paths.js

@@ -107,5 +107,7 @@ export {
   getLogFilePath,
   getTunnelProfilesFilePath,
   getLegacyCloudflareManagedRemoteFilePath,
+  readLastManagedLocalConfigPath,
+  writeLastManagedLocalConfigPath,
   getRunDir,
 };

packages/web/bin/lib/commands-tunnel.js

@@ -4,7 +4,7 @@ import path from 'path';
 import crypto from 'crypto';
 import { EXIT_CODE, TunnelCliError } from './cli-errors.js';
 import { DEFAULT_PORT, findClosestMatch, generateCompletionScript, showTunnelHelp } from './cli-args.js';
-import { requestJson, fetchSystemInfoFromPort } from './cli-http.js';
+import { requestJson, fetchSystemInfoFromPort, waitForServerHealth } from './cli-http.js';
 import {
   discoverRunningInstances,
   getLatestInstance,
@@ -34,7 +34,11 @@ import {
   resolveTunnelTtlOverrides,
 } from './cli-tunnel-utils.js';
 import { DEFAULT_TUNNEL_PROVIDER_CAPABILITIES } from './cli-tunnel-capabilities.js';
-import { assertSafeBrowserPort, buildLocalUrl } from './cli-network.js';
+import { assertSafeBrowserPort, buildLocalUrl, isUnsafeBrowserPort } from './cli-network.js';
+import {
+  readLastManagedLocalConfigPath,
+  writeLastManagedLocalConfigPath,
+} from './cli-paths.js';
 import {
   intro as clackIntro,
   outro as clackOutro,