rb-portless 0.4.0.dev.20260630.0d72797 → 0.4.0.dev.20260630.0e2b377

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8938cad2e70c50e9e39f2078fe9a8590b6f0324a136cd1da9f5a9258a0604c4f
-  data.tar.gz: 5fe88139d39e877e53b0adf46a87bd20ee361b23f3f858ca74d2039df3ee0562
+  metadata.gz: 0e0f20f5dbecd72651bb3e1d7509f41ae93d2a901336189d7776b58747008917
+  data.tar.gz: 90d742ec41737333d3f55a6552505379a8b097373eb95031edd32973f6a42689
 SHA512:
-  metadata.gz: e49cc73d6937721e37c41c4489755252c1cc815f1b687b2187a62c6e1a12c3c496d9f3eaf24a948957488ef0b8928f21862c4920225b707988938d53fb0f51bb
-  data.tar.gz: b4ef3864d39837cb27896997d22c24e4ee496c004bfa0a296a534ead61ed1a555936457e55600bcccc942ca41d776c9456ab4bd3dacfd81c7809719b1768bdd1
+  metadata.gz: 11ff15a4154575a926025f57192d9f663325b62df8054ba2fe403ad88db33aceebc4ae683082f5e4a6bc70f0ace369658dac8a35cd99e626e8d844cf577252b4
+  data.tar.gz: 99f4b875811a3f0a6a8c51a588d57d1877de0c722d232916e066654e738e12d47261adf2621b4581c7224932054cf7cbcabff75907e4cda4d421c409a238647d

data/AGENTS.md

@@ -64,6 +64,7 @@ injected as `PORT`; the proxy routes the named host to it.
 - **Phase 2 ✅** HTTP/2, full command surface (doctor/clean/prune/alias/get/hosts),
   boot service (launchd/systemd), daemon lifecycle.
 - **Phase 3 ✅ (partial)** framework `--port`/`--host` injection, Linux CA trust,
+  Firefox/Chrome NSS trust (`certutil` into each profile + `~/.pki/nssdb`),
   optional `portless/rails` railtie.
 
 - **Phase 4 ✅** startup banner; monorepo multi-app (`apps` map); LAN mode

data/lib/portless/daemon.rb

@@ -54,6 +54,8 @@ module Portless
         return spawn_detached(port: Constants::FALLBACK_PROXY_PORT, tls: tls)
       end
 
+      warn "rb-portless: binding :#{port} needs sudo (it's a privileged port) — " \
+           "enter your password to serve #{tls ? 'HTTPS' : 'HTTP'} without a port number"
       ok = Privilege.reexec_with_sudo([ "proxy", "start", "--port", port.to_s, tls ? "--tls" : "--no-tls" ])
       return wait_until_running(port) if ok
 

data/lib/portless/run_support.rb

@@ -8,13 +8,30 @@ module Portless
     private
 
     def child_env(port, url)
-      {
+      base = {
         "PORT" => port.to_s,
         "HOST" => "127.0.0.1",
         "PORTLESS_URL" => url,
         # Let the app's own server-side TLS verification trust our CA.
         "SSL_CERT_FILE" => (File.exist?(State.ca_cert) ? State.ca_cert : nil)
       }.compact
+      # Our own bundle (rb-portless is loaded via the app's Bundler binstub) must
+      # not leak into the dev command — a foreman-style `bin/dev` isn't in the
+      # app Gemfile and each Procfile process re-enters Bundler via its binstub.
+      unbundled_overrides.merge(base)
+    end
+
+    # ENV deltas that undo Bundler for the child (a nil value unsets the key).
+    # Empty when we're not running under Bundler at all.
+    def unbundled_overrides
+      return {} unless defined?(Bundler) && Bundler.respond_to?(:unbundled_env)
+
+      target = Bundler.unbundled_env
+      (ENV.keys | target.keys).each_with_object({}) do |key, deltas|
+        deltas[key] = target[key] if ENV[key] != target[key]
+      end
+    rescue StandardError
+      {}
     end
 
     def display_url(hostname, proxy_port)

data/lib/portless/trust.rb

@@ -2,12 +2,18 @@
 
 module Portless
   # Install / remove our CA in the OS trust store so browsers accept the per-host
-  # certs. macOS uses the login keychain (GUI/Touch-ID auth — no sudo). A
-  # ca.trusted fingerprint marker short-circuits the check. Linux/Windows land in
-  # phase 3. Mirrors portless's trustCA paths.
+  # certs. macOS uses the login keychain (GUI/Touch-ID auth — no sudo); Linux
+  # drops it in the distro anchor dir + runs update-ca-trust (sudo). Firefox and
+  # Chrome-on-Linux ignore the OS store and read their own NSS DBs, so we also
+  # install via `certutil` into every Firefox profile + `~/.pki/nssdb`. A
+  # ca.trusted fingerprint marker short-circuits the check. Mirrors mkcert/
+  # portless's trustCA paths.
   module Trust
     module_function
 
+    # The nickname our CA carries inside NSS DBs (Firefox/Chrome).
+    NSS_NICKNAME = "rb-portless Local CA"
+
     def certs = @certs ||= Certs.new
 
     def trusted?
@@ -24,12 +30,14 @@ module Portless
       else
         raise Error, unsupported_message
       end
+      install_nss # Firefox (every OS) + Chrome-on-Linux read their own NSS DBs.
       write_marker
     end
 
     def uninstall!
       return unless File.exist?(State.ca_cert)
 
+      uninstall_nss
       if Constants::MACOS
         system("security", "remove-trusted-cert", State.ca_cert)
       elsif linux?
@@ -78,6 +86,64 @@ module Portless
       Privilege.reexec_with_sudo([ "trust" ]) || raise(Error, "sudo required to trust the CA on Linux")
     end
 
+    # ── Firefox / Chrome NSS DBs (no sudo — they live under $HOME) ─────────
+    # Browsers that ship their own cert store ignore the OS trust anchor, so add
+    # the CA to each NSS DB directly. Best-effort: a missing certutil or a single
+    # failing profile must never abort the trust flow.
+    def install_nss
+      dbs = nss_dbs
+      return if dbs.empty?
+      return warn_no_certutil unless certutil
+
+      dbs.each do |db|
+        system(certutil, "-A", "-d", "sql:#{db}", "-t", "C,,", "-n", NSS_NICKNAME, "-i", State.ca_cert,
+               out: File::NULL, err: File::NULL)
+      end
+    end
+
+    def uninstall_nss
+      return unless certutil
+
+      nss_dbs.each do |db|
+        system(certutil, "-D", "-d", "sql:#{db}", "-n", NSS_NICKNAME, out: File::NULL, err: File::NULL)
+      end
+    end
+
+    # Every NSS DB worth trusting into: Chrome's shared store plus each Firefox
+    # profile. An NSS sql DB is a directory holding a cert9.db.
+    def nss_dbs(home = Dir.home)
+      ([ File.join(home, ".pki", "nssdb") ] + firefox_profiles(home))
+        .select { |db| File.exist?(File.join(db, "cert9.db")) }
+        .uniq
+    end
+
+    # Firefox keeps a profile dir (each with its own cert9.db) under a handful of
+    # roots depending on packaging — native, Snap, Flatpak, and macOS.
+    def firefox_profiles(home = Dir.home)
+      [
+        File.join(home, ".mozilla", "firefox"),
+        File.join(home, "snap", "firefox", "common", ".mozilla", "firefox"),
+        File.join(home, ".var", "app", "org.mozilla.firefox", ".mozilla", "firefox"),
+        File.join(home, "Library", "Application Support", "Firefox", "Profiles")
+      ].select { |root| File.directory?(root) }.flat_map do |root|
+        Dir.children(root).map { |child| File.join(root, child) }
+           .select { |dir| File.exist?(File.join(dir, "cert9.db")) }
+      end
+    end
+
+    def warn_no_certutil
+      warn "rb-portless: install `nss`/`libnss3-tools` (certutil) to trust the CA in Firefox/Chrome"
+    end
+
+    # certutil's path, or nil. Memoised; resolved off PATH so we never shell out
+    # just to probe for it.
+    def certutil
+      return @certutil if defined?(@certutil)
+
+      @certutil = ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).map { |dir| File.join(dir, "certutil") }
+                     .find { |path| File.executable?(path) && !File.directory?(path) }
+    end
+
     def linux? = RbConfig::CONFIG["host_os"] =~ /linux/i
 
     def marker_matches?
@@ -98,7 +164,7 @@ module Portless
     end
 
     def unsupported_message
-      "automatic CA trust isn't wired for this OS yet — trust #{State.ca_cert} manually (phase 3)"
+      "automatic CA trust isn't wired for this OS yet — trust #{State.ca_cert} manually"
     end
   end
 end

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.4.0.dev.20260630.0d72797"
+  VERSION = "0.4.0.dev.20260630.0e2b377"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.4.0.dev.20260630.0d72797
+  version: 0.4.0.dev.20260630.0e2b377
 platform: ruby
 authors:
 - David Afonso