rb-portless 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83441b74f46feaa32453bf004366f02a2b76e126994080f10fc4b8bfa654e93a
-  data.tar.gz: b1e86fecfc2575267871f74a92d011528db7a274997e0d6731dffa2bd12a5a19
+  metadata.gz: 47bfd748cef02443448a74938054d6cd57db229d76f286df305fbae28e4a2b7c
+  data.tar.gz: ba03fd513085d3d6cc56395792367a7211da79791dff2e2a8a017890af55ee5e
 SHA512:
-  metadata.gz: 2a9bb387e46841dfdaaa307575536736105df8709e49b82adccb0db1a4fbe1f7a8d295dcedca6a39c391d021cd54a2142c4c85f285c3bd4ad20190f307da3901
-  data.tar.gz: cbb9f4d7bd7cac01ba312e753a4b27dea8c23a632e1c7e8008f057caf2986499090e65e9eb8a7ff7e75c082a775826edb3b7daea22a9ab4603dffef287332349
+  metadata.gz: 140b4a24273bb2bce99a52fcd103b5a21fb7adb397cf4881d1928572985b1446d2c8137f56e5c6b0530359746742f29318c303f7b2b7e9406f075a80c63ea103
+  data.tar.gz: ea86eebc7033820eac77352a8178add894d22e08ec5564d92715f22538c239ed78aae1c2289bf1974452f7f61cd9faf00fad6bbee88009f61d1c98a8eae14d70

data/AGENTS.md

@@ -71,15 +71,41 @@ injected as `PORT`; the proxy routes the named host to it.
   (`--lan`: LanIp + mDNS `<name>.local`); public sharing (`--ngrok`/`--tailscale`/
   `--funnel`, experimental).
 
+- **Phase 5 ✅** end-to-end tests (`test/e2e_*_test.rb`, modeled on portless's
+  `tests/e2e`): a real proxy daemon on a high port + live backends. Cover
+  TLS/SNI, wildcard subdomains, X-Forwarded-*, HTTP/2, the WebSocket relay,
+  `run` lifecycle, and a real Rails app booted with the railtie.
+
 ### Roadmap (not yet built)
 
-- Windows CA trust + Task Scheduler service.
-- WebSocket upgrade relay hardening + HTTP/2 to the backend.
-- mDNS LAN-IP change monitoring (re-publish on network switch).
+Deliberately skipped for now (revisit on demand):
+
+- Windows CA trust + Task Scheduler service (no Windows machine to verify).
+- Custom certs (`proxy start --cert/--key` upstream) — niche; the local CA
+  covers the normal flow.
+- HTTP/2 to the backend, mDNS LAN-IP re-publish on network change, and a
+  brief backend retry-while-booting — low practical value in dev.
+- `PORTLESS_SYNC_HOSTS` auto hosts-sync (we keep `hosts sync` manual).
+
+### Test backlog
+
+- CLI arg edge cases (`alias` add/remove, `get`, `doctor` exit codes) and the
+  bin/dev → bin/rails resolved-command fallback.
+
+### Known divergences from portless (deliberate)
+
+- Wildcard subdomain fallback is always on (upstream defaults strict, opt-in
+  via `--wildcard`) — subdomain-per-tenant Rails apps are the headline here.
+- `portless.json` schema: `tld`/`tls` are ours; upstream keys `script`,
+  `proxy`, path-keyed `apps`, and package.json config don't apply to Ruby.
+- Health header is `x-rb-portless: <version>` (upstream: `X-Portless: 1`);
+  the version value drives the stale-proxy handshake.
 
 ## Conventions
 
 - Stdlib-first; the only runtime deps are `async` + `async-http` (for h1/h2/tls/ws).
 - Minitest + fixtures-free tests in `test/`; isolate state via `PORTLESS_STATE_DIR`.
+  The e2e layer (`test/e2e_helper.rb`) spawns the real daemon on a free high
+  port (no sudo) — Rails-stack gems in the Gemfile are test-only.
 - Mirror portless's naming/structure so the two stay diffable against
   `references/portless`.

data/CHANGELOG.md

@@ -4,6 +4,126 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.5.0]
+
+### Security
+
+- **The proxy listened on all interfaces.** It bound `0.0.0.0`, so every
+  registered dev app was reachable from the LAN, a VPN, or any other network
+  the machine sits on — no opt-in. The proxy (and the :80 redirect listener)
+  now binds the loopbacks only; `--lan` is the explicit opt-in, as a proxy
+  mode: `rb-portless run --lan` switches a loopback-only daemon over
+  automatically (persisted in a `proxy.lan` marker so restarts keep it), and
+  `proxy start --lan` does it by hand. Upstream portless shipped the same
+  change as a security fix.
+
+### Fixed
+
+- **HTTP/2 responses lost all headers and their body when the backend sent a
+  hop-by-hop header.** A backend `Connection: close` (or `Transfer-Encoding`,
+  `Keep-Alive`, …) was relayed verbatim into the h2 stream, where those headers
+  are illegal — the header block aborted mid-write and the client saw a bare
+  `200` with no headers and no body. The proxy now strips hop-by-hop headers
+  from backend responses (like portless), except on a 101 h1 upgrade where they
+  carry the WebSocket handshake.
+- **IPv6-first clients got `ECONNREFUSED`.** `*.localhost` resolves to `::1` as
+  well as `127.0.0.1`, but the proxy only bound IPv4 — clients without
+  Happy-Eyeballs fallback couldn't connect. The proxy now also listens on the
+  IPv6 loopback, best-effort (portless binds both).
+- **Generated Rails URLs dropped the proxy port.** `X-Forwarded-Host` was
+  stripped to the bare hostname, so whenever the proxy serves on a non-default
+  port (e.g. the `:1355` sudo-declined fallback) `request.url` and every
+  generated link pointed at the portless host *without* the port. The full
+  authority is now forwarded, as in portless.
+- **The railtie crashed apps without Action Cable.** The
+  `portless.action_cable_origins` initializer touched `config.action_cable`
+  unconditionally; API-only apps (or apps with trimmed railties) failed to boot
+  with `NoMethodError`. Now guarded.
+- **The railtie crashed apps that set `allowed_request_origins` to a bare
+  Regexp** (idiomatic — Rails' own development default is one) or a frozen
+  array: `concat` on it blew up boot. The origins list is now rebuilt with
+  `Array(existing) + ours`.
+- **A stale app-configured `:port` leaked into generated links.** With the
+  common `config.action_mailer.default_url_options = { host: "localhost",
+  port: 3000 }`, the railtie's merge kept `port: 3000` whenever the portless
+  URL had no explicit port — every mailer link pointed at
+  `https://<name>.localhost:3000`. The merge now drops `:port` unless the
+  portless URL carries one.
+- **Custom-tld subdomains beyond one label were 403'd.** Rails' leading-dot
+  host shorthand (`.myapp.test`) matches a single subdomain label, so
+  `a.b.myapp.test` failed host authorization while `a.b.myapp.localhost`
+  passed. Custom tlds now use a multi-level regexp like `.localhost` does.
+- **`--lan` devices hit Rails' blocked-host page.** The mDNS `<name>.local`
+  host was never whitelisted (it's not in any Rails default, and PORTLESS_URL
+  only carries the `.localhost` URL). `run --lan` now injects
+  `PORTLESS_LAN_HOST`, and the railtie whitelists it and adds a matching
+  Action Cable origin.
+- **`--tailscale`/`--funnel` requests were rejected by Rails.** The tunnel
+  forwards with the raw `*.ts.net` Host, which nothing whitelisted. The runner
+  now injects `PORTLESS_TAILSCALE_URL`/`PORTLESS_NGROK_URL` (parity with
+  portless), the railtie whitelists those hosts (+ Action Cable origins), and
+  the proxy also routes requests addressed to a route's share hostname
+  (upstream issue #297).
+- **`clean` left the boot service installed** — a surviving launchd/systemd
+  unit would resurrect the proxy against a deleted state dir. `clean` now
+  uninstalls it (only when one exists), and both `clean` and `prune` tear down
+  tailscale serve/funnel registrations recorded on (stale) routes.
+- **A plain `proxy restart` reverted to defaults.** The daemon now records its
+  TLS mode (like the LAN marker); `restart` preserves both unless
+  `--tls`/`--no-tls`/`--lan` are passed, and a project whose `tls` setting
+  disagrees with the running daemon gets a warning instead of silently
+  spawning a rival proxy on the default port.
+- **`clean`/re-trust cycles piled up CAs in the macOS keychain**
+  (`remove-trusted-cert` clears the trust setting but keeps the cert) — the
+  stale certificates are now deleted by CN.
+- **Monorepo runs took over other projects' routes unconditionally** —
+  `Multi` now honors `--force` like the single-app path.
+- Hostname labels (names, worktree branch prefixes) are clamped to the 63-char
+  DNS maximum — very long branch names produced invalid hostnames and
+  over-long cert filenames.
+
+### Changed
+
+- **Non-interactive privileged starts fail loudly instead of silently moving
+  to `:1355`.** When binding :443 needs sudo and there's no terminal (CI, task
+  runners), `run` used to fall back to `:1355` — quietly changing every URL.
+  It now exits with the ways out (pre-start the proxy, install the boot
+  service, or set `PORTLESS_PORT`), matching portless.
+- The proxy dials backends via `localhost` (both loopback families tried in
+  sequence), so an IPv6-only dev server (a Node app bound to `::1`) no longer
+  502s.
+- The 404 page now lists the active apps (clickable) and the `rb-portless
+  <name> <cmd>` command that would register the missing one.
+
+### Added
+
+- The `PORTLESS_*` env contract, parity with portless: `PORTLESS_HTTPS=0|1`
+  forces TLS off/on, `PORTLESS_TLD` overrides the tld, `PORTLESS_APP_PORT`
+  pins the backend port, and `PORTLESS_LAN` / `PORTLESS_NGROK` /
+  `PORTLESS_TAILSCALE` / `PORTLESS_FUNNEL` enable the matching run flags.
+  `PORTLESS_HOSTS_FILE` overrides the hosts-file path (tests, unusual
+  setups). Env overrides beat portless.json; explicit CLI flags beat both.
+- A 30s backend response-header timeout (504) so a backend that accepts and
+  then hangs can't hold client connections forever, and an (mtime, size) cache
+  for routes.json so the proxy no longer re-parses it on every request.
+- `X-Forwarded-For` on proxied requests (the client loopback/LAN address), so
+  `request.remote_ip` and request logs see the real client — parity with
+  portless.
+- `NODE_EXTRA_CA_CERTS` in the child env: Node dev servers ignore
+  `SSL_CERT_FILE`, so Node-side outbound HTTPS to portless hosts now trusts the
+  local CA too (an existing value is respected).
+- **End-to-end test suite** (`test/e2e_*_test.rb`), modeled on portless's
+  `tests/e2e`: boots the real proxy daemon on a high port plus live backends
+  and covers TLS/SNI cert verification, wildcard tenant subdomains,
+  `X-Forwarded-*`, HTTP/2, the full WebSocket relay, live route reloads,
+  404/502 pages, the daemon lifecycle (detached start → discovery → stop),
+  `run` (register → serve → deregister, process-group kill of a grandchild,
+  exit-status propagation), `PORTLESS=0` bypass, monorepo multi-app runs,
+  `prune` reaping an orphaned dev server, route-store lock contention across
+  processes — and a real Rails app booted with the railtie (host
+  authorization, `default_url_options`, mailer defaults, Action Cable
+  origins). Rails-stack gems are test-only.
+
 ## [0.4.1]
 
 ### Fixed

data/README.md

@@ -78,7 +78,8 @@ starts them all, each at its own name:
 ```
 
 **LAN mode** — reach the app from your phone on the same Wi-Fi. It detects the
-LAN IP, registers `<name>.local`, and publishes it over mDNS:
+LAN IP, registers `<name>.local`, publishes it over mDNS, and switches the
+proxy (loopback-only by default, for safety) to listen on the network:
 
 ```bash
 rb-portless run --lan bin/dev      # also → https://<name>.local
@@ -142,6 +143,11 @@ as a subdomain — `feature/auth` → `https://auth.<name>.localhost` — so eve
 gets a distinct URL. Pass `--no-worktree` (on `get`) to skip it. Set **`PORTLESS=0`**
 (`false`/`skip`) to run the command directly without the proxy.
 
+Every run flag has an env equivalent for scripts/CI: `PORTLESS_LAN`,
+`PORTLESS_NGROK`, `PORTLESS_TAILSCALE`, `PORTLESS_FUNNEL` (set to `1`),
+`PORTLESS_APP_PORT`, plus `PORTLESS_HTTPS=0|1` and `PORTLESS_TLD` overriding
+`portless.json`, and `PORTLESS_PORT` for the proxy port. Explicit flags win.
+
 ## Rails
 
 Rails is first-class: it respects `PORT` and trusts the loopback proxy, so

data/lib/portless/cli.rb

@@ -43,7 +43,7 @@ module Portless
     def cmd_run(args)
       options, command = parse_run(args)
       if command.empty? && Config.load.apps.any?
-        Multi.new.run # monorepo: portless.json `apps` map
+        Multi.new(options: options).run # monorepo: portless.json `apps` map
       else
         Runner.new(command: command, options: options).run
       end
@@ -67,7 +67,7 @@ module Portless
     # --lan/--ip, sharing (--ngrok/--tailscale/--funnel), --name, --force,
     # --app-port. Everything after `--` is the command verbatim.
     def parse_run(args)
-      options = {}
+      options = env_run_options
       command = []
       i = 0
       while i < args.length
@@ -88,12 +88,27 @@ module Portless
       [ options, command ]
     end
 
+    # Flag defaults from the PORTLESS_* env contract (explicit flags override
+    # by being parsed after these are seeded).
+    def env_run_options
+      options = {}
+      options[:lan] = true if Portless.env_true?("PORTLESS_LAN")
+      options[:ngrok] = true if Portless.env_true?("PORTLESS_NGROK")
+      options[:tailscale] = true if Portless.env_true?("PORTLESS_TAILSCALE")
+      options[:funnel] = true if Portless.env_true?("PORTLESS_FUNNEL")
+      app_port = Integer(ENV["PORTLESS_APP_PORT"].to_s, exception: false)
+      options[:app_port] = app_port if app_port
+      options
+    end
+
     def cmd_proxy(args)
       case args.first
       when "start"
-        Daemon.start(tls: tls_flag(args), port: int_flag(args, "--port"), foreground: flag?("--foreground"))
+        Daemon.start(tls: tls_flag(args), port: int_flag(args, "--port"),
+                     foreground: flag?("--foreground"), lan: args.include?("--lan"))
       when "stop"    then Daemon.stop
-      when "restart" then Daemon.restart(tls: tls_flag(args), port: int_flag(args, "--port"))
+      when "restart" then Daemon.restart(tls: explicit_tls_flag(args), port: int_flag(args, "--port"),
+                                         lan: args.include?("--lan") || nil)
       when nil       then command_help("proxy")
       else invalid_action!("proxy start|stop|restart")
       end
@@ -163,12 +178,18 @@ module Portless
       force = args.include?("--force")
       pruned = RouteStore.new.prune
       killed = pruned.sum { |r| PortOwner.kill(r.port, force: force) }
+      # A dead run's tailscale serve/funnel registration outlives it — reap it.
+      pruned.each { |r| safe { Share::Tailscale.stop_url(r.tailscale) } if r.tailscale }
       note = killed.positive? ? ", killed #{killed} orphan process(es)" : ""
       ok "pruned #{pruned.size} stale route(s)#{note}"
     end
 
     def cmd_clean(_args)
+      RouteStore.new.routes.each { |r| safe { Share::Tailscale.stop_url(r.tailscale) } if r.tailscale }
       Daemon.stop
+      # Otherwise a boot service survives and resurrects the proxy against a
+      # state dir that no longer exists.
+      begin; Service.uninstall if Service.installed?; rescue StandardError; end
       begin; Trust.uninstall!; rescue StandardError; end
       begin; with_hosts_write([ "hosts", "clean" ]) { Hosts.clean }; rescue StandardError; end
       require "fileutils"
@@ -250,6 +271,15 @@ module Portless
       true
     end
 
+    # nil unless the user passed --tls/--no-tls — restart preserves the running
+    # daemon's mode by default.
+    def explicit_tls_flag(args)
+      return false if args.include?("--no-tls")
+      return true if args.include?("--tls")
+
+      nil
+    end
+
     def int_flag(args, name)
       i = args.index(name)
       i ? Integer(args[i + 1], exception: false) : nil
@@ -327,8 +357,9 @@ module Portless
                      flags: [ [ "--force", "overwrite an existing route" ] ],
                      example: "rb-portless alias postgres 5432   # -> https://postgres.localhost" },
       "proxy"   => { summary: "Manage the proxy daemon.",
-                     usage: [ "proxy start [--no-tls] [--port <n>]", "proxy stop",
-                              "proxy restart   (pick up an updated rb-portless)" ] },
+                     usage: [ "proxy start [--no-tls] [--port <n>] [--lan]", "proxy stop",
+                              "proxy restart   (pick up an updated rb-portless)" ],
+                     flags: [ [ "--lan", "listen on all interfaces (default: loopback only)" ] ] },
       "trust"   => { summary: "Trust the local CA so HTTPS works without warnings.",
                      usage: [ "trust" ] },
       "hosts"   => { summary: "Manage the /etc/hosts block (Safari / non-.localhost TLDs).",

data/lib/portless/config.rb

@@ -16,9 +16,15 @@ module Portless
     def initialize(data, dir = Dir.pwd)
       @dir = dir
       @name = sanitize_label(data["name"] || infer_name(dir))
-      @tld = (data["tld"] || Constants::DEFAULT_TLD).to_s
+      # Env overrides beat portless.json (the portless env-var contract):
+      # PORTLESS_TLD replaces the tld, PORTLESS_HTTPS=0/1 forces TLS off/on.
+      @tld = (ENV["PORTLESS_TLD"] || data["tld"] || Constants::DEFAULT_TLD).to_s
       @app_port = data["appPort"] || data["app_port"]
       @tls = data.fetch("tls", true)
+      case ENV["PORTLESS_HTTPS"].to_s.downcase
+      when "0", "false" then @tls = false
+      when "1", "true" then @tls = true
+      end
       # Monorepo: { "apps": { "web": "bin/rails server", "api": "node api.js" } }.
       @apps = (data["apps"] || {}).transform_keys { |k| sanitize_label(k) }
     end
@@ -78,9 +84,11 @@ module Portless
       nil
     end
 
-    # A valid DNS label: lowercase alnum + hyphens, trimmed.
+    # A valid DNS label: lowercase alnum + hyphens, trimmed, clamped to the
+    # 63-char DNS maximum (long names would invalidate hostname + cert CN).
     def sanitize_label(value)
       label = value.to_s.downcase.gsub(/[^a-z0-9-]+/, "-").gsub(/\A-+|-+\z/, "")
+      label = label[0, 63].to_s.gsub(/-+\z/, "")
       label.empty? ? "app" : label
     end
   end

data/lib/portless/daemon.rb

@@ -10,14 +10,41 @@ module Portless
   module Daemon
     module_function
 
-    def ensure_running(tls:)
+    def ensure_running(tls:, lan: false)
       port = Health.discover_port
+      port = nil if tls && port == Constants::HTTP_PORT
+
+      if port && lan && !lan_active?
+        # The proxy binds loopback-only by default; --lan needs it reachable
+        # from the network, so switch the running daemon over.
+        warn "rb-portless: restarting the proxy in LAN mode (it was loopback-only)"
+        restart(tls: tls, port: port, lan: true)
+        return Health.discover_port || port
+      end
+      if port && !recorded_tls.nil? && recorded_tls != tls
+        # Another project started the daemon in the other TLS mode; don't fight
+        # over it — that used to spawn a rival proxy on the default port.
+        warn "rb-portless: the proxy is serving #{recorded_tls ? 'HTTPS' : 'HTTP'} but this project " \
+             "sets tls: #{tls} — keeping the running proxy " \
+             "(`rb-portless proxy restart #{tls ? '--tls' : '--no-tls'}` to switch)"
+      end
       return refresh_stale(port, tls: tls) if port
 
-      start(tls: tls)
+      start(tls: tls, lan: lan)
       Health.discover_port
     end
 
+    # Was the running proxy started in LAN mode? (Marker written by the daemon.)
+    def lan_active? = File.exist?(State.proxy_lan_file)
+
+    # The TLS mode the running daemon recorded, or nil (no marker / old daemon).
+    def recorded_tls
+      value = File.read(State.proxy_tls_file).strip
+      value != "0"
+    rescue StandardError
+      nil
+    end
+
     # The daemon outlives gem updates — after a `bundle update` the process on
     # :443 may still be running last week's code. Compare the version it stamps
     # on its responses with ours and offer to restart it; the reverse mismatch
@@ -59,25 +86,29 @@ module Portless
       !$stdin.gets.to_s.strip.downcase.start_with?("n")
     end
 
-    def restart(tls:, port: nil)
-      port ||= Health.discover_port
+    def restart(tls: nil, port: nil, lan: nil)
+      # A plain restart keeps the daemon's recorded modes; explicit flags win.
+      tls = recorded_tls if tls.nil?
+      tls = true if tls.nil?
+      lan = lan_active? if lan.nil?
+      port ||= Integer(ENV["PORTLESS_PORT"], exception: false) || default_port(tls)
       stop
       wait_until_stopped(port) if port
-      start(tls: tls, port: port)
+      start(tls: tls, port: port, lan: lan)
     end
 
     # foreground: become the daemon (binds the port, blocks). Otherwise
     # orchestrate: elevate if needed, then spawn the detached foreground daemon.
-    def start(tls:, port: nil, foreground: false)
+    def start(tls:, port: nil, foreground: false, lan: false)
       port ||= Integer(ENV["PORTLESS_PORT"], exception: false) || default_port(tls)
 
-      return Proxy.new(port: port, tls: tls).run if foreground
+      return Proxy.new(port: port, tls: tls, lan: lan).run if foreground
       return if Health.proxy_running?(port)
 
       if Privilege.needs_sudo?(port) && !Privilege.root?
-        start_privileged(port: port, tls: tls)
+        start_privileged(port: port, tls: tls, lan: lan)
       else
-        spawn_detached(port: port, tls: tls)
+        spawn_detached(port: port, tls: tls, lan: lan)
       end
     end
 
@@ -108,26 +139,33 @@ module Portless
       PortOwner.listeners(port).find { |pid| pid != Process.pid }
     end
 
-    def start_privileged(port:, tls:)
+    def start_privileged(port:, tls:, lan: false)
       unless Privilege.interactive?
-        warn "rb-portless: can't bind :#{port} without a terminal — using :#{Constants::FALLBACK_PROXY_PORT}"
-        return spawn_detached(port: Constants::FALLBACK_PROXY_PORT, tls: tls)
+        # Don't silently fall back to :1355 here — that changes every URL
+        # (OAuth redirect URIs, bookmarks) with nobody watching. Fail with the
+        # ways out instead, like portless does in CI.
+        raise NonInteractiveError,
+              "binding :#{port} needs sudo and there's no terminal to ask — pre-start the proxy " \
+              "(`rb-portless proxy start`), install the boot service (`rb-portless service install`), " \
+              "or set PORTLESS_PORT to an unprivileged port"
       end
 
       warn "rb-portless: binding :#{port} needs sudo (it's a privileged port) — " \
            "enter your password to serve #{tls ? 'HTTPS' : 'HTTP'} without a port number"
-      ok = Privilege.reexec_with_sudo([ "proxy", "start", "--port", port.to_s, tls ? "--tls" : "--no-tls" ])
+      ok = Privilege.reexec_with_sudo([ "proxy", "start", "--port", port.to_s,
+                                        tls ? "--tls" : "--no-tls", *(lan ? [ "--lan" ] : []) ])
       return wait_until_running(port) if ok
 
       warn "rb-portless: sudo declined — using :#{Constants::FALLBACK_PROXY_PORT}"
-      spawn_detached(port: Constants::FALLBACK_PROXY_PORT, tls: tls)
+      spawn_detached(port: Constants::FALLBACK_PROXY_PORT, tls: tls, lan: lan)
     end
 
-    def spawn_detached(port:, tls:)
+    def spawn_detached(port:, tls:, lan: false)
       State.ensure_dir!
       log = File.open(State.proxy_log, "a")
       args = [ RbConfig.ruby, "-I", lib_dir, Privilege.program,
-               "proxy", "start", "--foreground", "--port", port.to_s, tls ? "--tls" : "--no-tls" ]
+               "proxy", "start", "--foreground", "--port", port.to_s,
+               tls ? "--tls" : "--no-tls", *(lan ? [ "--lan" ] : []) ]
       pid = Process.spawn(*args, out: log, err: log, pgroup: true)
       Process.detach(pid)
       log.close

data/lib/portless/health.rb

@@ -46,7 +46,7 @@ module Portless
       ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
       ssl = OpenSSL::SSL::SSLSocket.new(socket, ctx)
       ssl.sync_close = true
-      ssl.connect
+      Timeout.timeout(timeout) { ssl.connect }
       ssl.write(REQUEST)
       # Read timeout too — a port that accepts but never answers must not hang us.
       Timeout.timeout(timeout) { ssl.read(4096) }

data/lib/portless/hosts.rb

@@ -10,7 +10,11 @@ module Portless
   module Hosts
     module_function
 
+    # PORTLESS_HOSTS_FILE overrides the target (tests; unusual setups).
     def file
+      override = ENV["PORTLESS_HOSTS_FILE"]
+      return override unless override.to_s.empty?
+
       Constants::WINDOWS ? File.join(ENV.fetch("SystemRoot", "C:/Windows"), "System32/drivers/etc/hosts") : "/etc/hosts"
     end
 

data/lib/portless/multi.rb

@@ -11,9 +11,10 @@ module Portless
 
     App = Struct.new(:name, :hostname, :port, :url, :pid, keyword_init: true)
 
-    def initialize(config: Config.load, route_store: RouteStore.new)
+    def initialize(config: Config.load, route_store: RouteStore.new, options: {})
       @config = config
       @route_store = route_store
+      @options = options # :force
       @apps = []
     end
 
@@ -38,7 +39,9 @@ module Portless
       prefix = @config.worktree_prefix
       hostname = "#{prefix ? "#{prefix}.#{name}" : name}.#{@config.tld}"
       url = display_url(hostname, proxy_port)
-      @route_store.add(hostname: hostname, port: port, pid: Process.pid, force: true)
+      # Same conflict semantics as the single-app path: a route held by another
+      # LIVE run raises unless --force (dead owners are reaped automatically).
+      @route_store.add(hostname: hostname, port: port, pid: Process.pid, force: !!@options[:force])
       # A bare command string runs through the shell (handles "bin/rails server").
       pid = Process.spawn(child_env(port, url), command, pgroup: true)
       App.new(name: name, hostname: hostname, port: port, url: url, pid: pid)

data/lib/portless/proxy.rb

@@ -20,9 +20,10 @@ module Portless
     HOP_BY_HOP = %w[connection keep-alive proxy-authenticate proxy-authorization
                     te trailers transfer-encoding upgrade host].freeze
 
-    def initialize(port:, tls: true, route_store: RouteStore.new, certs: Certs.new)
+    def initialize(port:, tls: true, lan: false, route_store: RouteStore.new, certs: Certs.new)
       @port = port
       @tls = tls
+      @lan = lan
       @route_store = route_store
       @certs = certs
       @clients = {}
@@ -41,19 +42,32 @@ module Portless
       install_signal_handlers
 
       Async do
-        make_server(listen_endpoint).run
+        listen_hosts.each { |host| make_server(endpoint_for(host)).run }
         start_redirect_listener if @tls && @port != Constants::HTTP_PORT
       end
     ensure
       cleanup
     end
 
-    # Exact host match, then wildcard fallback so *.name.localhost all reach the
+    # Loopback-only unless LAN mode was asked for: on 0.0.0.0 every registered
+    # dev app is reachable from the LAN/VPN by default (upstream shipped the
+    # same change as a security fix). `*.localhost` resolves to ::1 too, so an
+    # IPv6-loopback sibling always listens (best-effort — its bind failure
+    # surfaces as a logged task error, never fatal).
+    def listen_hosts
+      (@lan ? [ "0.0.0.0" ] : [ "127.0.0.1" ]) + [ "[::1]" ]
+    end
+
+    # Exact host match, then a route's public share hostname (tailscale/ngrok —
+    # requests forwarded by the tunnel keep the *.ts.net authority, upstream
+    # issue #297), then wildcard fallback so *.name.localhost all reach the
     # single app registered as name.localhost.
     def route_for(host)
-      host = host.to_s.split(":").first.to_s.downcase
+      authority = host.to_s.downcase.delete_suffix(":443")
+      host = authority.split(":").first.to_s
       routes = @route_store.routes
       routes.find { |r| r.hostname == host } ||
+        routes.find { |r| share_match?(r, authority, host) } ||
         routes.find { |r| host.end_with?(".#{r.hostname}") }
     end
 
@@ -63,23 +77,64 @@ module Portless
     def call(request)
       host = request_host(request)
       route = route_for(host)
-      return error(404, "No app is registered for #{host}.") unless route
+      return not_found(host) unless route
 
       hops = request.headers[HOP_HEADER].to_a.first.to_i
       return error(508, "Proxy loop detected for #{host}.") if hops >= Constants::MAX_PROXY_HOPS
 
-      response = client_for(route.port).call(build_forward(request, host, hops))
-      # The h1 backend accepts a WebSocket with 101 Switching Protocols, but
-      # HTTP/2 forbids 1xx finals — an extended-CONNECT success is a plain 2xx.
-      response.status = 200 if response.status == 101 && request.version == "HTTP/2"
+      response = with_backend_timeout do
+        client_for(route.port).call(build_forward(request, host, hops))
+      end
+      if response.status == 101 && request.version == "HTTP/2"
+        # The h1 backend accepts a WebSocket with 101 Switching Protocols, but
+        # HTTP/2 forbids 1xx finals — an extended-CONNECT success is a plain 2xx,
+        # and the h1 handshake headers are meaningless (and illegal) on h2.
+        response.status = 200
+        strip_hop_headers(response)
+        response.headers.delete("sec-websocket-accept")
+      elsif response.status != 101
+        # Hop-by-hop headers are single-hop by definition; relayed into an h2
+        # stream a backend's `Connection: close` aborts the whole header block,
+        # so the client sees a bare 200 with no headers and no body.
+        strip_hop_headers(response)
+      end
       response.headers.add(Constants::HEALTH_HEADER, VERSION)
       response
+    rescue Async::TimeoutError
+      error(504, "Backend for #{host} accepted the connection but never answered.")
     rescue StandardError => e
       error(502, "Backend for #{host} is not responding (#{e.class}).")
     end
 
     private
 
+    # Does the request authority match this route's public tunnel URL
+    # (https://<device>.ts.net[:port] / https://xxxx.ngrok.app)?
+    def share_match?(route, authority, host)
+      [ route.tailscale, route.ngrok ].compact.any? do |url|
+        uri = begin
+          URI(url)
+        rescue StandardError
+          nil
+        end
+        next false unless uri&.host
+
+        share = uri.port && uri.port != 443 ? "#{uri.host}:#{uri.port}" : uri.host
+        authority == share.downcase || host == uri.host.downcase
+      end
+    end
+
+    # Bound the wait for the backend's response *headers* (body streaming is
+    # unaffected) — a backend that accepts and then hangs must not hold client
+    # connections forever. No-op outside a reactor (unit tests drive #call
+    # directly).
+    BACKEND_HEADER_TIMEOUT = 30
+
+    def with_backend_timeout(&block)
+      task = Async::Task.current?
+      task ? task.with_timeout(BACKEND_HEADER_TIMEOUT, &block) : yield
+    end
+
     def make_server(endpoint)
       Async::HTTP::Server.for(endpoint) { |request| call(request) }
     end
@@ -97,9 +152,15 @@ module Portless
         key.downcase == "cookie" ? cookies << value : headers.add(key, value)
       end
       headers.add("cookie", cookies.join("; ")) unless cookies.empty?
-      headers.set("x-forwarded-host", host.split(":").first)
+      # Keep the full authority (host:port): Rails rebuilds request.url from
+      # X-Forwarded-Host, so stripping the port breaks generated URLs whenever
+      # the proxy serves on a non-default port (e.g. the :1355 fallback).
+      headers.set("x-forwarded-host", host)
       headers.set("x-forwarded-proto", @tls ? "https" : "http")
       headers.set("x-forwarded-port", @port.to_s)
+      # Append (repeated XFF fields join as a comma list) so Rails' remote_ip
+      # sees the real client — 127.0.0.1 locally, the device IP in LAN mode.
+      headers.add("x-forwarded-for", client_address(request))
       headers.add(HOP_HEADER, (hops + 1).to_s)
 
       # HTTP/2 WebSockets arrive as extended CONNECT (RFC 8441, :protocol on the
@@ -120,14 +181,27 @@ module Portless
       )
     end
 
+    def client_address(request)
+      request.remote_address&.ip_address || "127.0.0.1"
+    rescue StandardError
+      "127.0.0.1"
+    end
+
+    def strip_hop_headers(response)
+      HOP_BY_HOP.each { |key| response.headers.delete(key) }
+    end
+
     def client_for(port)
-      @clients[port] ||= Async::HTTP::Client.new(Async::HTTP::Endpoint.parse("http://127.0.0.1:#{port}"))
+      # "localhost", not 127.0.0.1: the endpoint tries each resolved address in
+      # sequence, so an IPv6-only backend (a Node server bound to ::1) still
+      # connects — portless happy-eyeballs both loopbacks the same way.
+      @clients[port] ||= Async::HTTP::Client.new(Async::HTTP::Endpoint.parse("http://localhost:#{port}"))
     end
 
-    def listen_endpoint
+    def endpoint_for(host)
       scheme = @tls ? "https" : "http"
       options = @tls ? { ssl_context: ssl_context } : {}
-      Async::HTTP::Endpoint.parse("#{scheme}://0.0.0.0:#{@port}", **options)
+      Async::HTTP::Endpoint.parse("#{scheme}://#{host}:#{@port}", **options)
     end
 
     # Base TLS context with an SNI callback that swaps in a per-host leaf cert.
@@ -152,13 +226,16 @@ module Portless
       end
     end
 
-    # A best-effort :80 listener that bounces plain HTTP to HTTPS.
+    # A best-effort :80 listener that bounces plain HTTP to HTTPS. Same bind
+    # scope as the main listeners (loopback unless LAN).
     def start_redirect_listener
-      endpoint = Async::HTTP::Endpoint.parse("http://0.0.0.0:#{Constants::HTTP_PORT}")
-      Async::HTTP::Server.for(endpoint) do |request|
-        host = request_host(request).split(":").first
-        Protocol::HTTP::Response[302, { "location" => "https://#{host}#{request.path}", Constants::HEALTH_HEADER => VERSION }, []]
-      end.run
+      listen_hosts.each do |host|
+        endpoint = Async::HTTP::Endpoint.parse("http://#{host}:#{Constants::HTTP_PORT}")
+        Async::HTTP::Server.for(endpoint) do |request|
+          request_host = request_host(request).split(":").first
+          Protocol::HTTP::Response[302, { "location" => "https://#{request_host}#{request.path}", Constants::HEALTH_HEADER => VERSION }, []]
+        end.run
+      end
     rescue StandardError
       nil # port 80 taken / unavailable — non-fatal.
     end
@@ -167,16 +244,53 @@ module Portless
       (request.authority || request.headers["host"].to_a.first).to_s
     end
 
-    def error(status, message)
+    # The 404 lists what IS running (clickable) plus the command that would
+    # register the missing name — upstream portless's most-loved error page.
+    def not_found(host)
+      safe_host = escape(host)
+      routes = @route_store.routes
+      suffix = @port == (@tls ? Constants::HTTPS_PORT : Constants::HTTP_PORT) ? "" : ":#{@port}"
+      scheme = @tls ? "https" : "http"
+      apps = if routes.empty?
+        "<p style='color:#888'>No apps are running.</p>"
+      else
+        items = routes.map do |r|
+          url = "#{scheme}://#{escape(r.hostname)}#{suffix}"
+          "<li><a href='#{url}'>#{escape(r.hostname)}</a> <span style='color:#888'>→ :#{r.port.to_i}</span></li>"
+        end
+        "<p>Active apps:</p><ul>#{items.join}</ul>"
+      end
+      name = host.to_s.split(":").first.to_s.split(".").first
+      name = "myapp" if name.empty?
+      hint = "<pre style='background:rgba(128,128,128,.15);padding:.75rem;border-radius:6px'>" \
+             "rb-portless #{escape(name)} bin/dev</pre>"
+      error(404, "No app is registered for <strong>#{safe_host}</strong>.", extra: "#{apps}#{hint}")
+    end
+
+    def error(status, message, extra: "")
       body = Protocol::HTTP::Body::Buffered.wrap("<!doctype html><meta charset=utf-8><title>rb-portless</title>" \
+        "<meta name=color-scheme content='light dark'>" \
         "<body style='font:16px system-ui;padding:3rem;max-width:40rem;margin:auto'>" \
-        "<h1>#{status}</h1><p>#{message}</p></body>")
+        "<h1>#{status}</h1><p>#{message}</p>#{extra}" \
+        "<p style='color:#888;margin-top:2rem'>rb-portless</p></body>")
       Protocol::HTTP::Response[status, { "content-type" => "text/html; charset=utf-8", Constants::HEALTH_HEADER => VERSION }, body]
     end
 
+    def escape(value)
+      value.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;").gsub('"', "&quot;").gsub("'", "&#39;")
+    end
+
     def write_markers
       File.write(State.proxy_pid_file, Process.pid.to_s)
       File.write(State.proxy_port_file, @port.to_s)
+      # Record how this daemon was started so restarts (and `run`'s
+      # mode-mismatch detection) can preserve/compare it.
+      File.write(State.proxy_tls_file, @tls ? "1" : "0")
+      if @lan
+        File.write(State.proxy_lan_file, "1")
+      elsif File.exist?(State.proxy_lan_file)
+        File.delete(State.proxy_lan_file)
+      end
       State.fix_ownership
     end
 
@@ -189,7 +303,10 @@ module Portless
     def cleanup
       return unless marker_pid == Process.pid
 
-      [ State.proxy_pid_file, State.proxy_port_file ].each { |f| File.delete(f) if File.exist?(f) }
+      [ State.proxy_pid_file, State.proxy_port_file,
+        State.proxy_lan_file, State.proxy_tls_file ].each do |f|
+        File.delete(f) if File.exist?(f)
+      end
     rescue StandardError
       nil
     end

data/lib/portless/rails.rb

@@ -43,10 +43,13 @@ module Portless
       # The router's defaults cover jobs and any request-less url_for (mailers
       # merge them in too). Set the mailer's own default_url_options via on_load
       # so we win over Rails' earlier action_mailer.set_configs regardless of
-      # railtie order.
-      app.routes.default_url_options.merge!(options)
+      # railtie order. merge_url_options drops a stale app-configured :port
+      # (e.g. `port: 3000`) that would otherwise survive into every link.
+      app.routes.default_url_options.replace(
+        RailsHosts.merge_url_options(app.routes.default_url_options, options)
+      )
       ActiveSupport.on_load(:action_mailer) do
-        self.default_url_options = default_url_options.merge(options)
+        self.default_url_options = RailsHosts.merge_url_options(default_url_options, options)
       end
     end
 
@@ -55,12 +58,17 @@ module Portless
     # localhost is rejected and Cable silently never connects.
     initializer "portless.action_cable_origins" do |app|
       next unless defined?(Rails) && Rails.env.development?
+      # Apps without Action Cable (API-only, trimmed railties) have no
+      # config.action_cable — touching it would crash boot.
+      next unless app.config.respond_to?(:action_cable)
 
       origins = RailsHosts.cable_origins
       next if origins.empty?
 
-      app.config.action_cable.allowed_request_origins ||= []
-      app.config.action_cable.allowed_request_origins.concat(origins)
+      # Array(): apps idiomatically set a bare Regexp (Rails' own dev default
+      # is one) — concat on it would crash boot; a frozen array would too.
+      app.config.action_cable.allowed_request_origins =
+        Array(app.config.action_cable.allowed_request_origins) + origins
     end
   end
 end

data/lib/portless/rails_hosts.rb

@@ -10,7 +10,7 @@ module Portless
     module_function
 
     # Empty unless we're actually running under rb-portless.
-    def allowed(portless_url = ENV["PORTLESS_URL"])
+    def allowed(portless_url = ENV["PORTLESS_URL"], lan_host = ENV["PORTLESS_LAN_HOST"])
       return [] if portless_url.to_s.empty?
 
       # Rails wraps a Regexp as /\A<re>(:port)?\z/, so match the whole host.
@@ -21,11 +21,40 @@ module Portless
       rescue StandardError
         nil
       end
-      # Support a custom, non-.localhost tld (e.g. *.myapp.test) too.
-      patterns.push(host, ".#{host}") if host && !host.end_with?(".localhost")
+      # A custom, non-.localhost tld too. A regexp, not a ".host" string —
+      # Rails' leading-dot shorthand only matches a single subdomain label,
+      # which would 403 a.b.myapp.test while a.b.myapp.localhost passes.
+      patterns.push(host, /.+\.#{Regexp.escape(host)}/) if host && !host.end_with?(".localhost")
+      # The `--lan` mDNS host (<name>.local) — not covered by any default.
+      patterns.push(lan_host) unless lan_host.to_s.empty?
+      # Public tunnels forward with their own Host (*.ts.net / *.ngrok.app).
+      patterns.concat(share_hosts)
       patterns
     end
 
+    # Hostnames of any active public tunnels (`--tailscale` / `--ngrok`),
+    # from the env the runner injects.
+    def share_hosts(env = ENV)
+      [ env["PORTLESS_TAILSCALE_URL"], env["PORTLESS_NGROK_URL"] ].filter_map do |url|
+        next if url.to_s.empty?
+
+        begin
+          URI(url).host
+        rescue StandardError
+          nil
+        end
+      end
+    end
+
+    # default_url_options merge that can't leave a stale :port behind: when the
+    # portless URL has no explicit port (443/80), an app-configured
+    # `port: 3000` must not survive into https://<name>.localhost:3000 links.
+    def merge_url_options(existing, options)
+      merged = existing.to_h.merge(options)
+      merged.delete(:port) unless options.key?(:port)
+      merged
+    end
+
     # The `default_url_options` (host + scheme) that mailers, jobs, and other
     # request-less URL generation need so their links point at the portless URL
     # instead of a bare `localhost:<random-port>`. Nil unless we're running
@@ -50,11 +79,15 @@ module Portless
     # `allowed_request_origins`; under rb-portless that's the portless host and
     # any of its subdomains (tenant hosts), over the portless scheme — not the
     # `localhost` default. Empty unless we're running under rb-portless.
-    def cable_origins(portless_url = ENV["PORTLESS_URL"])
+    def cable_origins(portless_url = ENV["PORTLESS_URL"], lan_host = ENV["PORTLESS_LAN_HOST"])
       options = url_options(portless_url) or return []
 
-      host = Regexp.escape(options[:host])
-      [ %r{\A#{options[:protocol]}://([\w-]+\.)*#{host}(:\d+)?\z} ]
+      hosts = [ options[:host] ]
+      hosts << lan_host unless lan_host.to_s.empty?
+      hosts.concat(share_hosts)
+      hosts.map do |host|
+        %r{\A#{options[:protocol]}://([\w-]+\.)*#{Regexp.escape(host)}(:\d+)?\z}
+      end
     end
   end
 end

data/lib/portless/route_store.rb

@@ -21,8 +21,20 @@ module Portless
       @lock = lock
     end
 
+    # The proxy calls this on every request; re-parsing routes.json each time is
+    # a syscall + JSON parse on the hot path. Cache on (mtime, size) — any write
+    # through with_lock touches both, so live reload still works.
     def routes
-      load.map do |h|
+      stat = begin
+        File.stat(@file)
+      rescue StandardError
+        nil
+      end
+      key = stat && [ stat.mtime, stat.size ]
+      return @routes_cache if key && key == @routes_cache_key
+
+      @routes_cache_key = key
+      @routes_cache = load.map do |h|
         Route.new(hostname: h["hostname"], port: h["port"], pid: h["pid"],
                   tailscale: h["tailscale"], ngrok: h["ngrok"])
       end

data/lib/portless/run_support.rb

@@ -12,10 +12,23 @@ module Portless
         "PORT" => port.to_s,
         "HOST" => "127.0.0.1",
         "PORTLESS_URL" => url,
+        # Under --lan, let the app (the Rails railtie) whitelist <name>.local
+        # too — it's not covered by any host-authorization default.
+        "PORTLESS_LAN_HOST" => @lan_host,
+        # Public tunnel URLs (when sharing): tailscale forwards with the raw
+        # *.ts.net Host, so the app must whitelist it — and apps can
+        # self-reference their public address (mirrors portless).
+        "PORTLESS_TAILSCALE_URL" => @tailscale&.dig(:url),
+        "PORTLESS_NGROK_URL" => @ngrok&.dig(:url),
         # Let the app's own server-side TLS verification trust our CA — via a
         # bundle that *also* carries the public roots, so SSL_CERT_FILE replacing
         # the trust store doesn't break the app's outbound HTTPS. See CaBundle.
-        "SSL_CERT_FILE" => CaBundle.path
+        "SSL_CERT_FILE" => CaBundle.path,
+        # Node ignores SSL_CERT_FILE; NODE_EXTRA_CA_CERTS *adds* to its default
+        # roots, so the bare CA is enough (mirrors portless). Respect an
+        # existing value — additions can only live in one file.
+        "NODE_EXTRA_CA_CERTS" => ENV["NODE_EXTRA_CA_CERTS"] ||
+          (State.ca_cert if File.exist?(State.ca_cert))
       }.compact
       # Our own bundle (rb-portless is loaded via the app's Bundler binstub) must
       # not leak into the dev command — a foreman-style `bin/dev` isn't in the

data/lib/portless/runner.rb

@@ -28,7 +28,7 @@ module Portless
 
       warn "rb-portless: #{@config.tld_warning}" if @config.tld_warning
       ensure_trusted
-      proxy_port = Daemon.ensure_running(tls: @config.tls)
+      proxy_port = Daemon.ensure_running(tls: @config.tls, lan: !!@options[:lan])
       @route_store.add(hostname: hostname, port: port, pid: Process.pid, force: @options[:force])
 
       url = display_url(hostname, proxy_port)

data/lib/portless/service.rb

@@ -28,6 +28,12 @@ module Portless
       puts "rb-portless: boot service removed"
     end
 
+    # Is a boot service on disk? (Both locations are world-readable, so this
+    # never needs sudo — `clean` uses it to skip a pointless elevation.)
+    def installed?
+      Constants::MACOS ? File.exist?(launchd_plist_path) : File.exist?(systemd_unit_path)
+    end
+
     def status
       if Constants::MACOS
         system("launchctl", "print", "system/#{LABEL}", out: $stdout, err: $stdout) ||

data/lib/portless/share/tailscale.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module Portless
   module Share
@@ -65,6 +66,23 @@ module Portless
         off(handle[:mode], handle[:port])
       end
 
+      # Teardown from a recorded share URL alone (clean/prune reaping a dead
+      # run's registration). The URL carries the HTTPS port (absent = 443); the
+      # mode isn't recorded, so turn off both — "not found" is a no-op.
+      def stop_url(url)
+        return unless url && Portless.which("tailscale")
+
+        port = begin
+          URI(url).port || 443
+        rescue StandardError
+          nil
+        end
+        return unless port
+
+        off("serve", port)
+        off("funnel", port)
+      end
+
       # Turn off ONLY the registration we created (scoped to our port).
       def off(mode, port)
         system("tailscale", mode, "--yes", "--https=#{port}", "off", out: File::NULL, err: File::NULL)
@@ -87,8 +105,7 @@ module Portless
       end
 
       # HTTPS ports the user's current serve config already occupies.
-      def used_serve_ports
-        config = JSON.parse(`tailscale serve status --json 2>/dev/null`)
+      def used_serve_ports(config = serve_status_json)
         ports = []
         (config["Web"] || {}).each_key { |host_port| ports << Regexp.last_match(1).to_i if host_port =~ /:(\d+)\z/ }
         (config["TCP"] || {}).each_key { |port| ports << port.to_i }
@@ -97,6 +114,12 @@ module Portless
         []
       end
 
+      def serve_status_json
+        JSON.parse(`tailscale serve status --json 2>/dev/null`)
+      rescue StandardError
+        {}
+      end
+
       def status_json
         json = JSON.parse(`tailscale status --json 2>/dev/null`)
         json.is_a?(Hash) ? json : nil

data/lib/portless/state.rb

@@ -26,6 +26,8 @@ module Portless
     def routes_lock = path("routes.lock")
     def proxy_pid_file = path("proxy.pid")
     def proxy_port_file = path("proxy.port")
+    def proxy_lan_file = path("proxy.lan")
+    def proxy_tls_file = path("proxy.tls")
     def proxy_log = path("proxy.log")
     def ca_cert = path("ca.pem")
     def ca_key = path("ca-key.pem")

data/lib/portless/trust.rb

@@ -40,6 +40,13 @@ module Portless
       uninstall_nss
       if Constants::MACOS
         system("security", "remove-trusted-cert", State.ca_cert)
+        # remove-trusted-cert clears the trust setting but leaves the cert in
+        # the keychain — repeated clean/reinstall cycles pile up CAs. Delete by
+        # CN (bounded loop: one entry per pass, tolerate several stale ones).
+        10.times do
+          break unless system("security", "delete-certificate", "-c", Certs::CA_SUBJECT.delete_prefix("/CN="),
+                              out: File::NULL, err: File::NULL)
+        end
       elsif linux?
         uninstall_linux
       end

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.4.1"
+  VERSION = "0.5.0"
 end

data/lib/portless/worktree.rb

@@ -58,12 +58,14 @@ module Portless
       end
     end
 
-    # Last `/`-segment of the branch, sanitized; nil for default/detached HEAD.
+    # Last `/`-segment of the branch, sanitized and clamped to the 63-char DNS
+    # label maximum; nil for default/detached HEAD.
     def branch_to_prefix(branch)
       return nil if branch.nil? || branch.empty? || branch == "HEAD"
       return nil if DEFAULT_BRANCHES.include?(branch)
 
       label = branch.split("/").last.to_s.downcase.gsub(/[^a-z0-9-]+/, "-").gsub(/\A-+|-+\z/, "")
+      label = label[0, 63].to_s.gsub(/-+\z/, "")
       label.empty? ? nil : label
     end
 

data/lib/rb-portless.rb

@@ -45,6 +45,9 @@ module Portless
   # the bypass portless documents for CI or one-off plain runs.
   def self.skip_proxy? = %w[0 false skip].include?(ENV["PORTLESS"].to_s.downcase)
 
+  # Truthy env toggle ("1"/"true"), for the PORTLESS_* flag equivalents.
+  def self.env_true?(name) = %w[1 true].include?(ENV[name].to_s.downcase)
+
   # Is an executable on PATH? (For optional external tools: dns-sd, ngrok, …)
   def self.which(bin)
     ENV["PATH"].to_s.split(File::PATH_SEPARATOR).any? { |dir| File.executable?(File.join(dir, bin)) }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - David Afonso
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-07 00:00:00.000000000 Z
+date: 2026-08-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async