Fix Holesail in Bare standalone via static import

createRequire(import.meta.url) could not resolve holesail inside the
packed app bundle even though holesail was embedded. Import holesail
statically so Bare resolution works; surface loadError in status banner.

server/services/holesail-tunnels.js

@@ -10,14 +10,15 @@
  * @see https://github.com/holesail/holesail
  * @see docs/HOLESAIL.md
  */
-import { createRequire } from 'module'
 import { randomBytes } from 'crypto'
 import fs from 'fs'
 import path from 'path'
+// Static import so bare-pack embeds holesail and Bare resolves it at load time.
+// Dynamic createRequire(import.meta.url) fails in standalone bundles (parent URL
+// does not match pack resolutions → "package missing").
+import HolesailModule from 'holesail'
 import logger from '../utils/logger.js'
 
-const require = createRequire(import.meta.url)
-
 /** @typedef {{
  *   id: string,
  *   name: string,
@@ -95,10 +96,21 @@ function loadHolesail() {
   if (HolesailCtor) return HolesailCtor
   if (holesailLoadError) throw holesailLoadError
   try {
-    HolesailCtor = require('holesail')
+    // CJS interop: module.exports = class Holesail → default under ESM
+    const mod = HolesailModule?.default ?? HolesailModule
+    if (typeof mod !== 'function') {
+      throw new Error(
+        `holesail export is not a constructor (got ${typeof mod})`
+      )
+    }
+    HolesailCtor = mod
     return HolesailCtor
   } catch (err) {
     holesailLoadError = err
+    logger.error('Failed to load holesail package', {
+      error: err?.message || String(err),
+      stack: err?.stack,
+    })
     throw err
   }
 }
@@ -489,13 +501,20 @@ async function safeClose(instance) {
 }
 
 export function holesailStatus() {
+  const available = isHolesailAvailable()
   return {
     enabled: isHolesailEnabled(),
-    available: isHolesailAvailable(),
+    available,
     active: tunnels.size,
     max: MAX_TUNNELS,
     allowedHosts: [...allowedTunnelHosts()],
     persistPath: persistPath(),
+    /** Present when available === false — helps diagnose bare packing / load issues */
+    loadError: available
+      ? null
+      : holesailLoadError?.message || holesailLoadError
+        ? String(holesailLoadError)
+        : 'unknown',
   }
 }