fix(cloudflare): kill cloudflared properly on dev exit

[Mkassabov]

Summary

Fixes a 530 error when restarting alchemy dev with dev: { tunnel: true } after switching Cloudflare profiles (or just restarting the dev server) on Windows.

Root cause

idempotentSpawn runs the child with shell: true, so the PID it records in .alchemy/pids/tunnel.pid.json is the cmd.exe wrapper, not cloudflared.exe. On cleanup we process.kill the wrapper, but Windows doesn't auto-kill its children — so cloudflared.exe orphans.

On the next alchemy dev run, one of two things happens:

1. The orphan is still alive and races against a freshly-spawned cloudflared. Whichever loses the race produces a stale trycloudflare.com host that gets baked into the deployed tunnel-proxy worker's TUNNEL_HOST binding. Requests forward to a dead tunnel → 530.
2. The state-file PID happens to still resolve (process.kill(pid, 0) is lenient) and idempotentSpawn reuses it, skipping the new spawn entirely — so the deployed TUNNEL_HOST points at a long-dead trycloudflare URL.

It worked on the first profile and broke on the second because no orphan exists before the very first dev run. It worked with tunnel: false because the cloudflared codepath is bypassed entirely.

Reproduced with two profiles + the playground worker; Get-Process cloudflared showed PID 54172 while tunnel.pid.json stored PID 33132 (the dead cmd.exe), confirming the orphan.

Fix

1. Add a shell?: boolean option to idempotentSpawn, default true (preserves current behavior for user-provided dev commands that rely on .cmd resolution / shell features). When false, parse cmd into argv and spawn directly — the stored PID is then the program's own PID.
2. Pass shell: false from the two cloudflared spawn sites (cloudflare/miniflare/tunnel.ts and cloudflare/quick-tunnel.ts); both run cloudflared tunnel --url <url>, which needs no shell features.
3. As defense-in-depth for the remaining shell: true callers (website / bun-spa dev commands), use taskkill /T /F /PID in kill() on Windows so the entire process tree is torn down instead of just the shell.

Test plan

• Repro: switch profile + restart dev → 530 (before fix)
• With patch installed in playground: switch profile + restart dev → worker responds normally
• Get-Process cloudflared after Ctrl+C now shows no orphan
• POSIX still works for the shell: false callers (cloudflared is on PATH, no shell features used)
• Website/bun-spa dev commands (npm run dev, etc.) still work — they remain shell: true

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/alchemy@1416

commit: 1e30679