rb-portless 0.4.0.dev.20260630.0e2b377 → 0.4.0.dev.20260704.9259a17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e0f20f5dbecd72651bb3e1d7509f41ae93d2a901336189d7776b58747008917
-  data.tar.gz: 90d742ec41737333d3f55a6552505379a8b097373eb95031edd32973f6a42689
+  metadata.gz: b9239a4ef5be3c67695e2633bf59fb8a08cbf5624a9bd3d413439529c198884d
+  data.tar.gz: f173e9ac7a171ed118cbc7a9df7c6244338a183841f0dfe6a961d42014e6b929
 SHA512:
-  metadata.gz: 11ff15a4154575a926025f57192d9f663325b62df8054ba2fe403ad88db33aceebc4ae683082f5e4a6bc70f0ace369658dac8a35cd99e626e8d844cf577252b4
-  data.tar.gz: 99f4b875811a3f0a6a8c51a588d57d1877de0c722d232916e066654e738e12d47261adf2621b4581c7224932054cf7cbcabff75907e4cda4d421c409a238647d
+  metadata.gz: bf329bdf61a50dd27b782b8f2ecf5141d052e986d5f03150bb3587bb2e0eeae61c21c62cfb45a875660de62e46893ec8696f4a56e681b38c7030e61ac5345fab
+  data.tar.gz: 3533215489c1e577481fe42a517157a9afecaa84b1f23da6c6e632e8579312e3931636a3cb1c380360433297b1337de627102e1444c8e905fd9adda2d93e126e

data/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.4.0]
+
+### Added
+
+- **Stale-proxy detection + `proxy restart`.** The proxy daemon outlives gem
+  updates, so a `bundle update` could leave last week's code holding :443
+  indefinitely. The proxy now stamps its version on every response (the health
+  header carries `VERSION` instead of a bare `1`), and `run` compares it with
+  the loaded gem: an older proxy prompts `restart the proxy? [Y/n]` (warn-only
+  without a TTY); a *newer* proxy warns that the project's gem is the stale
+  side. `rb-portless proxy restart` does the stop → wait → start dance manually,
+  and the startup banner always prints both sides (`v0.4.0 · proxy v0.4.0`) so a
+  drifting daemon is visible at a glance.
+
+- **`default_url_options` under portless.** The Rails integration now points
+  `config.action_mailer.default_url_options` and the router's default URL
+  options at `https://<name>.localhost` whenever the app runs under rb-portless
+  (dev only). Mailers and jobs — which build links without a request — stop
+  emitting stale `localhost:<port>` URLs, so apps no longer need to hardcode a
+  dev host. Untouched when not running under rb-portless.
+- **Action Cable origin allow-listing under portless.** The integration adds the
+  portless host and its subdomains to `config.action_cable.allowed_request_origins`
+  (dev only), so a WebSocket handshake from `https://<name>.localhost` isn't
+  rejected and Cable connects without extra config.
+
+### Fixed
+
+- **HTTP/2 cookie splitting corrupted the session.** Browsers speaking HTTP/2
+  may send one `cookie` header field per cookie (RFC 9113 §8.2.3); the proxy
+  forwarded them as repeated HTTP/1.1 `cookie:` lines, which the backend
+  (e.g. Puma) joins with `", "`. Rack then parses that single mangled field and
+  every cookie but the first is lost — silently emptying the Rails session and
+  breaking CSRF on every form POST. The proxy now concatenates split cookie
+  fields into one `"; "`-joined header, as an h2→h1 intermediary must.
+- **WebSockets from HTTP/2 browsers never reached the backend.** Firefox (and
+  any client using RFC 8441) opens `wss://` as an h2 *extended CONNECT* with
+  `:protocol: websocket`; the proxy forwarded the CONNECT verb raw, which the
+  HTTP/1.1 backend rejects as a parse error — Action Cable / Turbo Streams were
+  dead through the proxy. The proxy now translates: forwards it as `GET` +
+  `Upgrade` with a synthesized `Sec-WebSocket-Key` (extended CONNECT carries no
+  nonce, h1 backends demand one), and maps the backend's `101 Switching
+  Protocols` back to the `200` h2 requires. Verified end-to-end: an h2 extended
+  CONNECT through the old proxy → 400, through the fixed proxy → 200 with
+  Action Cable's welcome frame relayed.
+- **A failed second `proxy start` left the live daemon unstoppable.** The
+  latecomer overwrote the running daemon's pid/port marker files, then deleted
+  them in its own crash cleanup — after which `proxy stop` claimed no proxy was
+  running while a (often root-owned) daemon still held the port. A foreground
+  start now refuses the port when a proxy already answers on it, cleanup only
+  reaps markers the exiting process owns, and `proxy stop` falls back to
+  port-owner discovery (re-trying under sudo for a root daemon) when the
+  markers are gone.
+
 ## [0.3.1]
 
 ### Changed (internal — no behaviour change)

data/README.md

@@ -113,7 +113,7 @@ anything, same as portless), and each degrades gracefully if the tool is absent:
 | --- | --- |
 | `run <cmd>` | run a dev server through the proxy |
 | `<name> <cmd>` | shorthand for `run --name <name> <cmd>` |
-| `proxy start \| stop` | manage the proxy daemon |
+| `proxy start \| stop \| restart` | manage the proxy daemon (`restart` picks up an updated gem) |
 | `trust` | install the local CA into the OS trust store |
 | `service install \| uninstall \| status` | bind the privileged port at boot (launchd/systemd) |
 | `alias <name> <port> [--force]` | a static route (Docker, Postgres, …); `--remove` to drop it |

data/lib/portless/banner.rb

@@ -10,8 +10,8 @@ module Portless
 
     # rows: ordered [label, value, color] for the reachable URLs (Local,
     # Network, Public, …); backend is the real 127.0.0.1:port behind the proxy.
-    def app(rows:, backend_port:)
-      out = [ "", "  #{bold('rb-portless')} #{dim("v#{VERSION}")}", "" ]
+    def app(rows:, backend_port:, proxy_version: nil)
+      out = [ "", "  #{bold('rb-portless')} #{dim(versions(proxy_version))}", "" ]
       rows.each { |label, value, paint| out << row(label, send(paint || :cyan, value)) }
       out << row("Backend", dim("127.0.0.1:#{backend_port}"))
       out << ""
@@ -21,8 +21,8 @@ module Portless
     end
 
     # Multi-app: one row per app (name → URL).
-    def multi(apps:)
-      out = [ "", "  #{bold('rb-portless')} #{dim("v#{VERSION}")}", "" ]
+    def multi(apps:, proxy_version: nil)
+      out = [ "", "  #{bold('rb-portless')} #{dim(versions(proxy_version))}", "" ]
       apps.each { |app| out << row(app.name, cyan(app.url)) }
       out << ""
       out << "  #{dim('ready — press Ctrl-C to stop')}"
@@ -30,6 +30,14 @@ module Portless
       warn out.join("\n")
     end
 
+    # Always show both sides of the version handshake — a stale daemon is
+    # invisible otherwise (it keeps last week's code in memory across updates).
+    def versions(proxy_version)
+      return "v#{VERSION}" unless proxy_version
+
+      "v#{VERSION} · proxy v#{proxy_version}"
+    end
+
     def row(label, value) = "  #{green('➜')}  #{label.to_s.ljust(8)}#{value}"
 
     # ── colours (target stderr, where the banner is printed) ──

data/lib/portless/cli.rb

@@ -92,9 +92,10 @@ module Portless
       case args.first
       when "start"
         Daemon.start(tls: tls_flag(args), port: int_flag(args, "--port"), foreground: flag?("--foreground"))
-      when "stop" then Daemon.stop
-      when nil    then command_help("proxy")
-      else invalid_action!("proxy start|stop")
+      when "stop"    then Daemon.stop
+      when "restart" then Daemon.restart(tls: tls_flag(args), port: int_flag(args, "--port"))
+      when nil       then command_help("proxy")
+      else invalid_action!("proxy start|stop|restart")
       end
     end
 
@@ -282,7 +283,7 @@ module Portless
           rb-portless <name> <command>     run <command> at https://<name>.localhost
           rb-portless get <name>           print a service's URL (--no-worktree)
           rb-portless alias <name> <port>  static route for an unmanaged service
-          rb-portless proxy start|stop     manage the proxy daemon
+          rb-portless proxy start|stop|restart  manage the proxy daemon
           rb-portless trust                trust the local CA (HTTPS)
           rb-portless hosts sync|clean     manage /etc/hosts (Safari fallback)
           rb-portless list                 show active routes
@@ -326,7 +327,8 @@ module Portless
                      flags: [ [ "--force", "overwrite an existing route" ] ],
                      example: "rb-portless alias postgres 5432   # -> https://postgres.localhost" },
       "proxy"   => { summary: "Manage the proxy daemon.",
-                     usage: [ "proxy start [--no-tls] [--port <n>]", "proxy stop" ] },
+                     usage: [ "proxy start [--no-tls] [--port <n>]", "proxy stop",
+                              "proxy restart   (pick up an updated rb-portless)" ] },
       "trust"   => { summary: "Trust the local CA so HTTPS works without warnings.",
                      usage: [ "trust" ] },
       "hosts"   => { summary: "Manage the /etc/hosts block (Safari / non-.localhost TLDs).",

data/lib/portless/daemon.rb

@@ -12,12 +12,60 @@ module Portless
 
     def ensure_running(tls:)
       port = Health.discover_port
-      return port if port
+      return refresh_stale(port, tls: tls) if port
 
       start(tls: tls)
       Health.discover_port
     end
 
+    # The daemon outlives gem updates — after a `bundle update` the process on
+    # :443 may still be running last week's code. Compare the version it stamps
+    # on its responses with ours and offer to restart it; the reverse mismatch
+    # (a newer proxy) means this project's gem is the stale side.
+    def refresh_stale(port, tls:)
+      running = Health.proxy_version(port)
+      case version_action(running, VERSION)
+      when :restart
+        if restart_consented?(running)
+          restart(tls: tls, port: port)
+          port = Health.discover_port || port
+        else
+          warn "rb-portless: keeping the v#{running} proxy — run `rb-portless proxy restart` when ready"
+        end
+      when :update_gem
+        warn "rb-portless: the proxy is v#{running} but this project loads rb-portless v#{VERSION} — " \
+             "update the gem (`bundle update rb-portless`) so they match"
+      end
+      port
+    end
+
+    # nil → proxy unreadable or versions equal: leave it alone.
+    def version_action(running, current)
+      return nil unless running
+
+      case Gem::Version.new(running) <=> Gem::Version.new(current)
+      when -1 then :restart
+      when 1 then :update_gem
+      end
+    rescue ArgumentError
+      nil
+    end
+
+    def restart_consented?(running)
+      warn "rb-portless: the running proxy is v#{running}; this rb-portless is v#{VERSION}"
+      return false unless Privilege.interactive?
+
+      $stderr.print "rb-portless: restart the proxy to pick up the update? [Y/n] "
+      !$stdin.gets.to_s.strip.downcase.start_with?("n")
+    end
+
+    def restart(tls:, port: nil)
+      port ||= Health.discover_port
+      stop
+      wait_until_stopped(port) if port
+      start(tls: tls, port: port)
+    end
+
     # foreground: become the daemon (binds the port, blocks). Otherwise
     # orchestrate: elevate if needed, then spawn the detached foreground daemon.
     def start(tls:, port: nil, foreground: false)
@@ -34,8 +82,12 @@ module Portless
     end
 
     def stop
-      pid = read_pid
+      pid = read_pid || discovered_pid
       unless pid
+        # A proxy answers but we can't see who owns the port (a root daemon
+        # whose marker files were lost) — retry the whole stop under sudo.
+        return Privilege.reexec_with_sudo([ "proxy", "stop" ]) if Health.discover_port && !Privilege.root?
+
         warn "rb-portless: no proxy is running"
         return
       end
@@ -48,6 +100,14 @@ module Portless
       Privilege.reexec_with_sudo([ "proxy", "stop" ]) unless Privilege.root?
     end
 
+    # Fallback when the pid marker is missing: whoever listens on the port the
+    # proxy answered from (lsof only sees our own processes unless root).
+    def discovered_pid
+      port = Health.discover_port or return nil
+
+      PortOwner.listeners(port).find { |pid| pid != Process.pid }
+    end
+
     def start_privileged(port:, tls:)
       unless Privilege.interactive?
         warn "rb-portless: can't bind :#{port} without a terminal — using :#{Constants::FALLBACK_PROXY_PORT}"
@@ -85,6 +145,17 @@ module Portless
       true
     end
 
+    # A restart can't rebind the port until the old daemon has let go of it.
+    def wait_until_stopped(port, timeout: 10)
+      deadline = monotonic + timeout
+      while Health.proxy_running?(port)
+        return false if monotonic > deadline
+
+        sleep 0.2
+      end
+      true
+    end
+
     def default_port(tls) = tls ? Constants::HTTPS_PORT : Constants::HTTP_PORT
 
     def read_pid

data/lib/portless/health.rb

@@ -16,7 +16,28 @@ module Portless
     REQUEST = "HEAD / HTTP/1.0\r\nHost: rb-portless.localhost\r\n\r\n"
 
     def proxy_running?(port, timeout: 1.0)
-      probe_tls(port, timeout) || probe_plain(port, timeout)
+      !probe(port, timeout).nil?
+    end
+
+    # The running proxy's version, read from the health header it stamps on
+    # every response. Nil when no proxy answers on the port.
+    def proxy_version(port, timeout: 1.0)
+      version_from(probe(port, timeout))
+    end
+
+    # Proxies since 0.4.0 stamp their version as the header value; older ones
+    # stamped a bare "1" — report those as "0.0.0" so any release compares newer.
+    def version_from(response)
+      value = response.to_s[/^#{Regexp.escape(Constants::HEALTH_HEADER)}:\s*(\S+)/i, 1]
+      return nil unless value
+
+      value.match?(/\A\d+\.\d+/) ? value : "0.0.0"
+    end
+
+    # The raw probe response when it's our proxy answering, else nil.
+    def probe(port, timeout)
+      response = probe_tls(port, timeout) || probe_plain(port, timeout)
+      marker?(response) ? response : nil
     end
 
     def probe_tls(port, timeout)
@@ -28,9 +49,9 @@ module Portless
       ssl.connect
       ssl.write(REQUEST)
       # Read timeout too — a port that accepts but never answers must not hang us.
-      marker?(Timeout.timeout(timeout) { ssl.read(4096) })
+      Timeout.timeout(timeout) { ssl.read(4096) }
     rescue StandardError
-      false
+      nil
     ensure
       ssl&.close
       socket&.close unless ssl
@@ -40,10 +61,10 @@ module Portless
       Socket.tcp("127.0.0.1", port, connect_timeout: timeout) do |sock|
         sock.write(REQUEST)
         sock.close_write
-        marker?(Timeout.timeout(timeout) { sock.read(4096) })
+        Timeout.timeout(timeout) { sock.read(4096) }
       end
     rescue StandardError
-      false
+      nil
     end
 
     def marker?(response) = response.to_s.downcase.include?(Constants::HEALTH_HEADER)

data/lib/portless/multi.rb

@@ -24,7 +24,7 @@ module Portless
       proxy_port = Daemon.ensure_running(tls: @config.tls)
       @apps = @config.apps.map { |name, command| start_app(name, command, proxy_port) }
 
-      Banner.multi(apps: @apps)
+      Banner.multi(apps: @apps, proxy_version: Health.proxy_version(proxy_port))
       install_signal_handlers
       Process.waitall
     ensure

data/lib/portless/proxy.rb

@@ -6,6 +6,7 @@ require "async/http/client"
 require "async/http/endpoint"
 require "protocol/http/headers"
 require "protocol/http/body/buffered"
+require "securerandom"
 
 module Portless
   # The reverse proxy daemon (async-http: HTTP/1.1 + TLS + WebSockets; HTTP/2 in
@@ -30,6 +31,11 @@ module Portless
 
     def run
       State.ensure_dir!
+      # A second daemon on the same port would overwrite the live one's marker
+      # files, then wipe them on its own EADDRINUSE crash — leaving the survivor
+      # unstoppable by `proxy stop`. Refuse before touching any state.
+      raise Error, "a proxy is already running on :#{@port}" if Health.proxy_running?(@port)
+
       @certs.ensure_ca! if @tls
       write_markers
       install_signal_handlers
@@ -63,7 +69,10 @@ module Portless
       return error(508, "Proxy loop detected for #{host}.") if hops >= Constants::MAX_PROXY_HOPS
 
       response = client_for(route.port).call(build_forward(request, host, hops))
-      response.headers.add(Constants::HEALTH_HEADER, "1")
+      # The h1 backend accepts a WebSocket with 101 Switching Protocols, but
+      # HTTP/2 forbids 1xx finals — an extended-CONNECT success is a plain 2xx.
+      response.status = 200 if response.status == 101 && request.version == "HTTP/2"
+      response.headers.add(Constants::HEALTH_HEADER, VERSION)
       response
     rescue StandardError => e
       error(502, "Backend for #{host} is not responding (#{e.class}).")
@@ -77,16 +86,36 @@ module Portless
 
     def build_forward(request, host, hops)
       headers = Protocol::HTTP::Headers.new
+      cookies = []
       request.headers.each do |key, value|
-        headers.add(key, value) unless HOP_BY_HOP.include?(key.downcase)
+        next if HOP_BY_HOP.include?(key.downcase)
+
+        # HTTP/2 clients may split the cookie header into one field per cookie
+        # (RFC 9113 §8.2.3); an intermediary translating to HTTP/1.1 MUST
+        # concatenate them with "; " — otherwise the backend joins the repeated
+        # lines with "," and cookie parsing (split on ";") corrupts the values.
+        key.downcase == "cookie" ? cookies << value : headers.add(key, value)
       end
+      headers.add("cookie", cookies.join("; ")) unless cookies.empty?
       headers.set("x-forwarded-host", host.split(":").first)
       headers.set("x-forwarded-proto", @tls ? "https" : "http")
       headers.set("x-forwarded-port", @port.to_s)
       headers.add(HOP_HEADER, (hops + 1).to_s)
 
+      # HTTP/2 WebSockets arrive as extended CONNECT (RFC 8441, :protocol on the
+      # request); the HTTP/1.1 equivalent is GET + Upgrade, which the client
+      # layer emits from request.protocol. Forwarded raw, the CONNECT verb makes
+      # the backend's parser reject the stream. Extended CONNECT also drops
+      # Sec-WebSocket-Key (h2 needs no handshake nonce), but an h1 backend
+      # refuses an upgrade without one — synthesize it.
+      method = request.method
+      if method == "CONNECT" && request.protocol
+        method = "GET"
+        headers.set("sec-websocket-key", SecureRandom.base64(16)) if headers["sec-websocket-key"].nil?
+      end
+
       Protocol::HTTP::Request.new(
-        "http", host, request.method, request.path, request.version,
+        "http", host, method, request.path, request.version,
         headers, request.body, request.protocol
       )
     end
@@ -128,7 +157,7 @@ module Portless
       endpoint = Async::HTTP::Endpoint.parse("http://0.0.0.0:#{Constants::HTTP_PORT}")
       Async::HTTP::Server.for(endpoint) do |request|
         host = request_host(request).split(":").first
-        Protocol::HTTP::Response[302, { "location" => "https://#{host}#{request.path}", Constants::HEALTH_HEADER => "1" }, []]
+        Protocol::HTTP::Response[302, { "location" => "https://#{host}#{request.path}", Constants::HEALTH_HEADER => VERSION }, []]
       end.run
     rescue StandardError
       nil # port 80 taken / unavailable — non-fatal.
@@ -142,7 +171,7 @@ module Portless
       body = Protocol::HTTP::Body::Buffered.wrap("<!doctype html><meta charset=utf-8><title>rb-portless</title>" \
         "<body style='font:16px system-ui;padding:3rem;max-width:40rem;margin:auto'>" \
         "<h1>#{status}</h1><p>#{message}</p></body>")
-      Protocol::HTTP::Response[status, { "content-type" => "text/html; charset=utf-8", Constants::HEALTH_HEADER => "1" }, body]
+      Protocol::HTTP::Response[status, { "content-type" => "text/html; charset=utf-8", Constants::HEALTH_HEADER => VERSION }, body]
     end
 
     def write_markers
@@ -155,10 +184,18 @@ module Portless
       %w[INT TERM].each { |sig| trap(sig) { cleanup; exit(0) } }
     end
 
+    # Only reap markers we own — a crashing latecomer must never delete the
+    # live daemon's pid/port files.
     def cleanup
+      return unless marker_pid == Process.pid
+
       [ State.proxy_pid_file, State.proxy_port_file ].each { |f| File.delete(f) if File.exist?(f) }
     rescue StandardError
       nil
     end
+
+    def marker_pid
+      Integer(File.read(State.proxy_pid_file).strip, exception: false) if File.exist?(State.proxy_pid_file)
+    end
   end
 end

data/lib/portless/rails.rb

@@ -5,10 +5,16 @@
 #   gem "rb-portless", require: "portless/rails"
 #
 # It auto-detects when the app is being run through `rb-portless run` (via the
-# PORTLESS_URL env the runner injects) and *only then* whitelists the matching
-# `*.localhost` hosts in development — so Action Dispatch host authorization
-# doesn't 403 your named subdomains. Run Rails normally (not under rb-portless)
-# and nothing is touched. Lightweight: does NOT load the proxy stack.
+# PORTLESS_URL env the runner injects) and *only then*:
+#
+#   * whitelists the matching `*.localhost` hosts in development — so Action
+#     Dispatch host authorization doesn't 403 your named subdomains, and
+#   * points `default_url_options` at the portless URL — so mailers and jobs
+#     (which generate links without a request) link to https://<name>.localhost
+#     instead of a bare localhost:<random-port>.
+#
+# Run Rails normally (not under rb-portless) and nothing is touched. Lightweight:
+# does NOT load the proxy stack.
 require "rails/railtie"
 require_relative "rails_hosts"
 
@@ -22,5 +28,39 @@ module Portless
         app.config.hosts << pattern unless app.config.hosts.include?(pattern)
       end
     end
+
+    # Under rb-portless the app is reached at https://<name>.localhost, not the
+    # random backend port — so request-less URL generation must target that. We
+    # own default_url_options here (authoritatively, when running under portless)
+    # rather than leave every app to hardcode a now-wrong localhost:port in
+    # development.rb. `config.action_mailer.default_url_options` is applied to the
+    # mailer lazily on load, so setting it after the env config still wins.
+    initializer "portless.default_url_options" do |app|
+      next unless defined?(Rails) && Rails.env.development?
+
+      options = RailsHosts.url_options or next
+
+      # The router's defaults cover jobs and any request-less url_for (mailers
+      # merge them in too). Set the mailer's own default_url_options via on_load
+      # so we win over Rails' earlier action_mailer.set_configs regardless of
+      # railtie order.
+      app.routes.default_url_options.merge!(options)
+      ActiveSupport.on_load(:action_mailer) do
+        self.default_url_options = default_url_options.merge(options)
+      end
+    end
+
+    # Allow the portless origin (and its subdomains) through Action Cable's
+    # WebSocket origin check — otherwise the handshake from https://<name>.
+    # localhost is rejected and Cable silently never connects.
+    initializer "portless.action_cable_origins" do |app|
+      next unless defined?(Rails) && Rails.env.development?
+
+      origins = RailsHosts.cable_origins
+      next if origins.empty?
+
+      app.config.action_cable.allowed_request_origins ||= []
+      app.config.action_cable.allowed_request_origins.concat(origins)
+    end
   end
 end

data/lib/portless/rails_hosts.rb

@@ -25,5 +25,36 @@ module Portless
       patterns.push(host, ".#{host}") if host && !host.end_with?(".localhost")
       patterns
     end
+
+    # The `default_url_options` (host + scheme) that mailers, jobs, and other
+    # request-less URL generation need so their links point at the portless URL
+    # instead of a bare `localhost:<random-port>`. Nil unless we're running
+    # under rb-portless. The standard 80/443 ports are dropped (portless serves
+    # without a port number); a custom one is carried through.
+    def url_options(portless_url = ENV["PORTLESS_URL"])
+      return if portless_url.to_s.empty?
+
+      uri = begin
+        URI(portless_url)
+      rescue StandardError
+        nil
+      end
+      return unless uri&.host
+
+      options = { host: uri.host, protocol: uri.scheme }
+      options[:port] = uri.port if uri.port && ![ 80, 443 ].include?(uri.port)
+      options
+    end
+
+    # Action Cable rejects a WebSocket whose `Origin` isn't in
+    # `allowed_request_origins`; under rb-portless that's the portless host and
+    # any of its subdomains (tenant hosts), over the portless scheme — not the
+    # `localhost` default. Empty unless we're running under rb-portless.
+    def cable_origins(portless_url = ENV["PORTLESS_URL"])
+      options = url_options(portless_url) or return []
+
+      host = Regexp.escape(options[:host])
+      [ %r{\A#{options[:protocol]}://([\w-]+\.)*#{host}(:\d+)?\z} ]
+    end
   end
 end

data/lib/portless/runner.rb

@@ -36,7 +36,7 @@ module Portless
       rows.concat(lan_rows(port, proxy_port))
       rows.concat(share_rows(hostname, port))
       record_share_urls(hostname, port) # so `rb-portless list` shows the public URLs
-      Banner.app(rows: rows, backend_port: port)
+      Banner.app(rows: rows, backend_port: port, proxy_version: Health.proxy_version(proxy_port))
 
       status = supervise(command, port, url)
       exit(status)

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.4.0.dev.20260630.0e2b377"
+  VERSION = "0.4.0.dev.20260704.9259a17"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.4.0.dev.20260630.0e2b377
+  version: 0.4.0.dev.20260704.9259a17
 platform: ruby
 authors:
 - David Afonso
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-30 00:00:00.000000000 Z
+date: 2026-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async