@dutodev/cli 0.6.0 → 1.0.0

package/dist/index.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import {
+  C,
+  TRUNCATED_NOTE,
+  bodyNote,
   formatBytes,
   formatDuration,
   formatTime,
@@ -7,7 +10,7 @@ import {
   normalizeName,
   statusColor,
   validateName
-} from "./chunk-26EQC6HB.js";
+} from "./chunk-BPOXISIM.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -17,7 +20,6 @@ function colorOn(stream = process.stdout) {
 }
 var SGR = {
   signal: "38;2;45;212;191",
-  // #2dd4bf
   muted: "38;2;138;143;139",
   strong: "1",
   ok: "38;2;74;222;128",
@@ -30,6 +32,7 @@ function paint(tone, text, stream) {
 var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
 var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
 var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
+var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
 
 // src/index.ts
 import { hostname } from "os";
@@ -48,9 +51,9 @@ var DutoApiError = class extends Error {
   code;
 };
 var MESSAGES = {
-  unauthorized: "Authtoken inv\xE1lido. Gere um novo em https://duto.dev e rode: duto login <token>",
-  suspended: "Sua conta est\xE1 suspensa.",
-  network: "N\xE3o consegui falar com duto.dev. Verifique sua conex\xE3o."
+  unauthorized: "Invalid authtoken. Generate a new one at https://duto.dev and run: duto login <token>",
+  suspended: "Your account is suspended.",
+  network: "Could not reach duto.dev. Check your connection."
 };
 function createApiClient(o) {
   const doFetch = o.fetchImpl ?? fetch;
@@ -76,7 +79,7 @@ function createApiClient(o) {
     const code = data.error ?? "http_error";
     if (res.status === 401) throw new DutoApiError(MESSAGES.unauthorized, 401, code);
     if (res.status === 403 && code === "suspended") throw new DutoApiError(MESSAGES.suspended, 403, code);
-    throw new DutoApiError(data.message ?? `Erro ${res.status} ao falar com duto.dev.`, res.status, code);
+    throw new DutoApiError(data.message ?? `duto.dev returned HTTP ${res.status}.`, res.status, code);
   }
   async function json(method, path, body) {
     const res = await call(method, path, body);
@@ -165,7 +168,7 @@ function assetFor(platform, arch) {
     case "win32/x64":
       return { asset: "cloudflared-windows-amd64.exe", kind: "exe" };
     default:
-      throw new Error(`Plataforma n\xE3o suportada: ${key}`);
+      throw new Error(`Unsupported platform: ${key}`);
   }
 }
 function downloadUrl(asset, version = CLOUDFLARED_VERSION) {
@@ -180,13 +183,13 @@ async function ensureCloudflared(opts = {}) {
   opts.onDownload?.();
   mkdirSync2(binDir, { recursive: true });
   const res = await (opts.fetchImpl ?? fetch)(downloadUrl(asset));
-  if (!res.ok) throw new Error(`N\xE3o consegui baixar o cloudflared (HTTP ${res.status}).`);
+  if (!res.ok) throw new Error(`Could not download cloudflared (HTTP ${res.status}).`);
   const bytes = Buffer.from(await res.arrayBuffer());
   const expected = (opts.checksums ?? CHECKSUMS)[asset];
   const actual = createHash("sha256").update(bytes).digest("hex");
   if (!expected || actual !== expected) {
     rmSync(target, { force: true });
-    throw new Error("Falha na verifica\xE7\xE3o do cloudflared");
+    throw new Error("cloudflared checksum mismatch. Try again; if it keeps failing, update duto.");
   }
   const tmp = mkdtempSync(join2(binDir, ".download-"));
   try {
@@ -213,13 +216,13 @@ async function ensureCloudflaredWithProgress(write, opts = {}) {
       ...opts,
       onDownload: () => {
         downloading = true;
-        write("\u2193 Baixando cloudflared (s\xF3 na primeira vez)... ");
+        write("\u2193 Downloading cloudflared (first run only)... ");
       }
     });
     if (downloading) write("ok\n");
     return path;
   } catch (err) {
-    if (downloading) write("falhou\n");
+    if (downloading) write("failed\n");
     throw err;
   }
 }
@@ -270,8 +273,8 @@ var SOURCES = {
   github: { url: "https://api.github.com/meta", pick: (j) => j?.hooks }
 };
 function splitCidr(raw) {
-  const [ip, p, ...resto] = raw.split("/");
-  if (!ip || resto.length) return null;
+  const [ip, p, ...extra] = raw.split("/");
+  if (!ip || extra.length) return null;
   const v = isIP(ip);
   if (!v) return null;
   const max = v === 4 ? 32 : 128;
@@ -307,9 +310,9 @@ async function fetchRanges(name, f) {
   const res = await f(src.url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { accept: "application/json" } });
   if (!res.ok) throw new Error(`HTTP ${res.status}`);
   const list = src.pick(await res.json());
-  if (!Array.isArray(list)) throw new Error("formato inesperado");
+  if (!Array.isArray(list)) throw new Error("unexpected format");
   const out = list.filter((x) => typeof x === "string" && splitCidr(x) !== null);
-  if (!out.length) throw new Error("lista vazia");
+  if (!out.length) throw new Error("empty list");
   return out.map((x) => x.includes("/") ? x : `${x}/${splitCidr(x).prefix}`);
 }
 async function resolveAllow(entries, o = {}) {
@@ -321,7 +324,8 @@ async function resolveAllow(entries, o = {}) {
   const cached = readCache(cacheFile);
   const fresh = cached && now - cached.fetchedAt >= 0 && now - cached.fetchedAt < CACHE_MS ? cached : null;
   const lists = {};
-  if (fresh && names.every((n) => Array.isArray(fresh.lists[n]) && fresh.lists[n].length)) {
+  const coversEveryName = fresh && names.every((n) => Array.isArray(fresh.lists[n]) && fresh.lists[n].length);
+  if (fresh && coversEveryName) {
     for (const n of names) lists[n] = fresh.lists[n];
   } else {
     const net = {};
@@ -332,7 +336,8 @@ async function resolveAllow(entries, o = {}) {
         lists[name] = ALLOW_SNAPSHOT[name];
       }
     }
-    if (names.length && Object.keys(net).length === names.length) {
+    const everyListFromNetwork = names.length > 0 && Object.keys(net).length === names.length;
+    if (everyListFromNetwork) {
       try {
         mkdirSync3(dirname(cacheFile), { recursive: true });
         writeFileSync3(cacheFile, JSON.stringify({ fetchedAt: now, lists: net }));
@@ -362,7 +367,7 @@ import { dirname as dirname2, join as join4 } from "path";
 import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
-    super(!file ? message2 : line ? `${file}, linha ${line}: ${message2}` : `${file}: ${message2}`);
+    super(!file ? message2 : line ? `${file}, line ${line}: ${message2}` : `${file}: ${message2}`);
     this.line = line;
     this.name = "ConfigError";
   }
@@ -372,7 +377,7 @@ var CONFIG_FILES = ["duto.yml", "duto.yaml"];
 var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "permitir"];
+var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "allow"];
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -398,11 +403,11 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
   const lineAt = (offset) => offset === void 0 ? void 0 : lc.linePos(offset).line;
   if (doc.errors.length) {
     const e = doc.errors[0];
-    throw fail3("YAML inv\xE1lido. Confira a indenta\xE7\xE3o e os dois-pontos.", lineAt(e.pos[0]));
+    throw fail3("invalid YAML. Check the indentation and the colons.", lineAt(e.pos[0]));
   }
   const tunnels = isMap(doc.contents) ? doc.contents.get("tunnels", true) : void 0;
   if (!isMap(tunnels) || tunnels.items.length === 0) {
-    throw fail3('declare os t\xFAneis em "tunnels:", um por linha (ex.: web: 3000).');
+    throw fail3('declare the tunnels under "tunnels:", one per line (e.g. web: 3000)');
   }
   const specs = [];
   for (const pair of tunnels.items) {
@@ -412,40 +417,40 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
     const v = validateName(name);
     if (!v.ok) {
       throw fail3(
-        v.reason === "reserved" ? `nome reservado: "${raw}". Escolha outro.` : `nome inv\xE1lido: "${raw}" (use s\xF3 letras min\xFAsculas e n\xFAmeros, sem h\xEDfen)`,
+        v.reason === "reserved" ? `reserved name: "${raw}". Choose another.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
         line
       );
     }
     const port = portOf(pair.value);
-    if (port === null) throw fail3(`porta inv\xE1lida para "${raw}" (use 1\u201365535)`, line);
+    if (port === null) throw fail3(`invalid port for "${raw}" (use 1\u201365535)`, line);
     const spec = { name, port };
     if (isMap(pair.value)) {
       const body = pair.value;
       for (const item of body.items) {
         const key = isScalar(item.key) ? String(item.key.value) : "";
-        if (!TUNNEL_KEYS.includes(key)) throw fail3(`chave desconhecida em "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth ou permitir)`, line);
+        if (!TUNNEL_KEYS.includes(key)) throw fail3(`unknown key in "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth or allow)`, line);
       }
       const hostNode = body.get("host", true);
       if (hostNode !== void 0) {
         const host = isScalar(hostNode) && typeof hostNode.value === "string" ? parseHost(hostNode.value) : null;
-        if (!host) throw fail3(`host inv\xE1lido para "${raw}": use s\xF3 o dom\xEDnio, como meuapp.test`, line);
+        if (!host) throw fail3(`invalid host for "${raw}": use only the domain, like myapp.test`, line);
         spec.host = host;
       }
       const headersNode = body.get("headers", true);
       if (headersNode !== void 0) {
-        if (!isMap(headersNode)) throw fail3(`headers de "${raw}" deve ser uma lista de Nome: valor`, line);
+        if (!isMap(headersNode)) throw fail3(`headers in "${raw}" must be a list of Name: value`, line);
         const headers = {};
         for (const h of headersNode.items) {
           const hName = isScalar(h.key) ? String(h.key.value) : "";
           const hLine = lineAt(h.key?.range?.[0]);
-          if (!HEADER_NAME_RE.test(hName)) throw fail3(`cabe\xE7alho inv\xE1lido em "${raw}": "${hName}"`, hLine);
-          if (hName.toLowerCase() === "host") throw fail3(`para trocar o Host de "${raw}", use host: em vez de headers`, hLine);
+          if (!HEADER_NAME_RE.test(hName)) throw fail3(`invalid header in "${raw}": "${hName}"`, hLine);
+          if (hName.toLowerCase() === "host") throw fail3(`to change the Host of "${raw}", use host: instead of headers`, hLine);
           const value = h.value === null ? null : isScalar(h.value) ? h.value.value : void 0;
           if (value !== null && !["string", "number", "boolean"].includes(typeof value)) {
-            throw fail3(`valor inv\xE1lido para o cabe\xE7alho "${hName}" em "${raw}"`, hLine);
+            throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
           }
           const str = value === null ? "" : String(value);
-          if (/[\r\n]/.test(str)) throw fail3(`valor inv\xE1lido para o cabe\xE7alho "${hName}" em "${raw}"`, hLine);
+          if (/[\r\n]/.test(str)) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
           headers[hName.toLowerCase()] = str;
         }
         spec.headers = headers;
@@ -453,50 +458,50 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
       const rewriteNode = body.get("rewrite_redirects", true);
       if (rewriteNode !== void 0) {
         const value = isScalar(rewriteNode) ? rewriteNode.value : void 0;
-        if (typeof value !== "boolean") throw fail3(`rewrite_redirects de "${raw}" deve ser true ou false`, line);
-        if (!spec.host) throw fail3(`rewrite_redirects de "${raw}" s\xF3 vale junto com host:`, line);
+        if (typeof value !== "boolean") throw fail3(`rewrite_redirects in "${raw}" must be true or false`, line);
+        if (!spec.host) throw fail3(`rewrite_redirects in "${raw}" only works together with host:`, line);
         if (value === false) spec.rewriteRedirects = false;
       }
       const authNode = body.get("auth", true);
       if (authNode !== void 0) {
-        if (!isSeq(authNode)) throw fail3(`auth de "${raw}" deve ser uma lista de usuario:senha`, line);
+        if (!isSeq(authNode)) throw fail3(`auth in "${raw}" must be a list of user:password`, line);
         const auth = [];
         for (const item of authNode.items) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const text2 = isScalar(item) && typeof item.value === "string" ? item.value : null;
-          if (text2 === null) throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
+          if (text2 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
           const expanded = text2.replace(ENV_REF_RE, (_m, name2) => {
             const val = env[name2];
-            if (val === void 0) throw fail3(`vari\xE1vel de ambiente ${name2} n\xE3o definida (usada em auth de "${raw}")`, iLine);
+            if (val === void 0) throw fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine);
             return val;
           });
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
-            if (parsed.reason === "format") throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
-            if (parsed.reason === "user") throw fail3(`usu\xE1rio inv\xE1lido em "${raw}": de 1 a 128 caracteres, sem espa\xE7o`, iLine);
-            throw fail3(`senha de "${expanded.slice(0, expanded.indexOf(":"))}" em "${raw}" precisa ter de 8 a 128 caracteres`, iLine);
+            if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
+            if (parsed.reason === "user") throw fail3(`invalid user in "${raw}": 1 to 128 characters, no spaces`, iLine);
+            throw fail3(`password for "${expanded.slice(0, expanded.indexOf(":"))}" in "${raw}" must be 8 to 128 characters`, iLine);
           }
-          if (auth.some((c) => c.user === parsed.cred.user)) throw fail3(`usu\xE1rio "${parsed.cred.user}" aparece duas vezes em "${raw}"`, iLine);
+          if (auth.some((c) => c.user === parsed.cred.user)) throw fail3(`user "${parsed.cred.user}" appears twice in "${raw}"`, iLine);
           auth.push(parsed.cred);
         }
-        if (!auth.length) throw fail3(`auth de "${raw}" n\xE3o pode ficar vazia`, line);
+        if (!auth.length) throw fail3(`auth in "${raw}" cannot be empty`, line);
         spec.auth = auth;
       }
-      const allowNode = body.get("permitir", true);
+      const allowNode = body.get("allow", true);
       if (allowNode !== void 0) {
-        if (!isSeq(allowNode)) throw fail3(`permitir de "${raw}" deve ser uma lista`, line);
-        if (!spec.auth) throw fail3(`permitir de "${raw}" s\xF3 vale junto com auth:`, line);
+        if (!isSeq(allowNode)) throw fail3(`allow in "${raw}" must be a list`, line);
+        if (!spec.auth) throw fail3(`allow in "${raw}" only works together with auth:`, line);
         const allow = [];
         for (const item of allowNode.items) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const value = isScalar(item) ? String(item.value) : "";
-          if (!parseAllowEntry(value)) throw fail3(`permitir de "${raw}": "${value}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`, iLine);
+          if (!parseAllowEntry(value)) throw fail3(`allow in "${raw}": "${value}" is not a known name (stripe, github) or an IP range`, iLine);
           allow.push(value);
         }
         if (allow.length) spec.allow = allow;
       }
     }
-    if (specs.some((s) => s.name === name)) throw fail3(`o nome "${raw}" aparece duas vezes`, line);
+    if (specs.some((s) => s.name === name)) throw fail3(`the name "${raw}" appears twice`, line);
     specs.push(spec);
   }
   return specs;
@@ -505,7 +510,7 @@ function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
     const present = CONFIG_FILES.filter((f) => existsSync3(join4(dir, f)));
-    if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" e ")} na mesma pasta. Apague um dos dois.`, void 0, "");
+    if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" and ")} in the same folder. Delete one of them.`, void 0, "");
     if (present.length === 1) {
       const path = join4(dir, present[0]);
       return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0]) };
@@ -517,6 +522,914 @@ function findConfig(cwd) {
   }
 }
 
+// src/inspector/jsonView.ts
+function countLabel(n, one, many) {
+  return n + " " + (n === 1 ? one : many);
+}
+function jsonSyntaxError(text) {
+  try {
+    JSON.parse(text);
+    return null;
+  } catch (e) {
+    const message2 = String(e && e.message ? e.message : e);
+    const m = /position (\d+)/.exec(message2);
+    if (m) return { position: Number(m[1]), message: message2 };
+    const lc = /line (\d+) column (\d+)/.exec(message2);
+    if (lc) {
+      let idx = 0;
+      for (let ln = 1; ln < Number(lc[1]); ln++) {
+        const nl = text.indexOf("\n", idx);
+        if (nl < 0) return { position: text.length, message: message2 };
+        idx = nl + 1;
+      }
+      return { position: Math.min(idx + Number(lc[2]) - 1, text.length), message: message2 };
+    }
+    return { position: text.length, message: message2 };
+  }
+}
+function jsonTokens(text) {
+  const out = [];
+  let depth = 0;
+  let i = 0;
+  while (i < text.length) {
+    const c = text.charAt(i);
+    let j = i + 1;
+    let kind;
+    if (c === " " || c === "\n" || c === "	" || c === "\r") {
+      while (j < text.length && " \n	\r".indexOf(text.charAt(j)) >= 0) j++;
+      kind = "space";
+    } else if (c === '"') {
+      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
+      j = Math.min(j + 1, text.length);
+      let k = j;
+      while (k < text.length && " \n	\r".indexOf(text.charAt(k)) >= 0) k++;
+      kind = text.charAt(k) === ":" ? "key" : "string";
+    } else if ("{}[],:".indexOf(c) >= 0) {
+      kind = "punct";
+      if (c === "}" || c === "]") depth = Math.max(0, depth - 1);
+    } else {
+      while (j < text.length && ' \n	\r{}[],:"'.indexOf(text.charAt(j)) < 0) j++;
+      const word = text.slice(i, j);
+      kind = word === "true" || word === "false" || word === "null" ? "literal" : "number";
+    }
+    out.push({ kind, text: text.slice(i, j), depth });
+    if (kind === "punct" && (c === "{" || c === "[")) depth++;
+    i = j;
+  }
+  return out;
+}
+function jsonIndent(text) {
+  let out = "";
+  let depth = 0;
+  let i = 0;
+  const ws = " \n	\r";
+  while (i < text.length) {
+    const c = text.charAt(i);
+    if (ws.indexOf(c) >= 0) {
+      i++;
+    } else if (c === '"') {
+      let j = i + 1;
+      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
+      out += text.slice(i, j + 1);
+      i = j + 1;
+    } else if (c === "{" || c === "[") {
+      let j = i + 1;
+      while (j < text.length && ws.indexOf(text.charAt(j)) >= 0) j++;
+      if (text.charAt(j) === (c === "{" ? "}" : "]")) {
+        out += c + text.charAt(j);
+        i = j + 1;
+      } else {
+        depth++;
+        out += c + "\n" + "  ".repeat(depth);
+        i++;
+      }
+    } else if (c === "}" || c === "]") {
+      depth = Math.max(0, depth - 1);
+      out += "\n" + "  ".repeat(depth) + c;
+      i++;
+    } else if (c === ",") {
+      out += ",\n" + "  ".repeat(depth);
+      i++;
+    } else if (c === ":") {
+      out += ": ";
+      i++;
+    } else {
+      let j = i + 1;
+      while (j < text.length && (ws + '{}[],:"').indexOf(text.charAt(j)) < 0) j++;
+      out += text.slice(i, j);
+      i = j;
+    }
+  }
+  return out;
+}
+
+// src/inspector/page.ts
+var BG = "#111413";
+var BAR = "#0b0d0c";
+var LINE = "#222826";
+var ROW_LINE = "#1a1f1d";
+var INPUT_LINE = "#2a312e";
+var TEXT = "#e7e9e6";
+var SELECTED = "#16201e";
+var JSON_KEY = "#93c5fd";
+var JSON_STRING = "#fdba74";
+var JSON_VALUE = "#c4b5fd";
+var MONO = '"JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace';
+var STYLE = `
+:root { color-scheme: dark; }
+* { box-sizing: border-box; }
+html, body { height: 100%; }
+body { margin: 0; background: ${BG}; color: ${TEXT}; font-family: ${MONO}; font-size: 13px; line-height: 1.45; }
+button { font: inherit; color: inherit; background: none; border: 0; padding: 0; cursor: pointer; }
+:focus-visible { outline: 1px solid ${C.signal}; outline-offset: -1px; }
+.app { display: flex; flex-direction: column; height: 100vh; }
+.top { display: flex; justify-content: space-between; gap: 16px; padding: 8px 12px; background: ${BAR}; border-bottom: 1px solid ${LINE}; color: ${C.muted}; }
+.top b { color: ${C.signal}; font-weight: 600; }
+.tunnels { display: flex; flex-wrap: wrap; gap: 4px 14px; justify-content: flex-end; min-width: 0; }
+.tunnels .k { color: ${C.strong}; }
+.banner { padding: 6px 12px; background: ${BAR}; border-bottom: 1px solid ${C.err}; color: ${C.err}; }
+.main { flex: 1; min-height: 0; display: grid; grid-template-columns: 320px 1fr; }
+.side { display: flex; flex-direction: column; min-height: 0; border-right: 1px solid ${LINE}; }
+.search { margin: 8px 12px; padding: 5px 8px; border: 1px solid ${INPUT_LINE}; border-radius: 5px; background: ${BG}; color: ${TEXT}; font: inherit; outline: none; }
+.search:focus { border-color: ${C.signal}; }
+.search::placeholder { color: ${C.muted}; }
+.list { flex: 1; min-height: 0; overflow-y: auto; outline: none; }
+.row { display: grid; grid-template-columns: 14px 42px minmax(0, 1fr) 34px 56px; gap: 8px; padding: 5px 12px; border-bottom: 1px solid ${ROW_LINE}; align-items: center; cursor: pointer; white-space: nowrap; }
+.list.multi .row { grid-template-columns: 14px 56px 42px minmax(0, 1fr) 34px 56px; }
+.row:hover { background: #141917; }
+.row.sel { background: ${SELECTED}; box-shadow: inset 2px 0 0 ${C.signal}; }
+.row span { overflow: hidden; text-overflow: ellipsis; }
+.row .dur { text-align: right; }
+.m { font-weight: 700; }
+.mut { color: ${C.muted}; }
+.empty { padding: 12px; color: ${C.muted}; }
+.detail { display: flex; flex-direction: column; min-height: 0; min-width: 0; }
+.pane { flex: 1; }
+.head { padding: 8px 12px; overflow-wrap: anywhere; }
+.head b { color: ${C.strong}; }
+.tabs { display: flex; gap: 14px; padding: 8px 12px 0; border-bottom: 1px solid ${LINE}; }
+.tab { color: ${C.muted}; padding-bottom: 6px; border-bottom: 2px solid transparent; }
+.tab:hover { color: ${TEXT}; }
+.tab.on { color: ${C.strong}; border-bottom-color: ${C.signal}; }
+.content { flex: 1; min-height: 0; overflow: auto; }
+.content pre { margin: 0; padding: 10px 12px; line-height: 1.55; white-space: pre-wrap; overflow-wrap: anywhere; font: inherit; }
+.note { padding: 10px 12px; color: ${C.muted}; }
+.trunc { padding: 0 12px 10px; color: ${C.warn}; }
+.jerr { padding: 10px 12px 0; color: ${C.err}; }
+.bad { background: ${C.err}40; color: ${C.strong}; }
+.k { color: ${JSON_KEY}; } .s { color: ${JSON_STRING}; } .n { color: ${JSON_VALUE}; }
+.fold.closed > .inner { display: none; }
+.fold > .sum { display: none; color: ${C.muted}; }
+.fold.closed > .sum { display: inline; }
+.open { cursor: pointer; }
+.open:hover { color: ${C.signal}; }
+table { border-collapse: collapse; margin: 6px 12px 10px; }
+th, td { text-align: left; vertical-align: top; padding: 3px 16px 3px 0; border-bottom: 1px solid ${ROW_LINE}; overflow-wrap: anywhere; }
+th { color: ${JSON_KEY}; font-weight: 400; white-space: nowrap; }
+.sect { padding: 10px 12px 0; color: ${C.muted}; }
+.btns { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; padding: 8px 12px; border-top: 1px solid ${LINE}; }
+.btn { border: 1px solid ${INPUT_LINE}; border-radius: 5px; padding: 3px 8px; }
+.btn:hover:not(:disabled) { border-color: ${C.muted}; }
+.btn.pri { border-color: ${C.signal}; color: ${C.signal}; }
+.btn:disabled { color: ${C.muted}; border-color: ${ROW_LINE}; cursor: default; }
+.msg { color: ${C.muted}; }
+.msg.err { color: ${C.err}; }
+[hidden] { display: none !important; }
+@media (max-width: 720px) {
+  .main { grid-template-columns: 1fr; grid-template-rows: 40vh 1fr; }
+  .side { border-right: 0; border-bottom: 1px solid ${LINE}; }
+}
+`;
+var SCRIPT = String.raw`"use strict";
+var countLabel = (${countLabel.toString()});
+var jsonSyntaxError = (${jsonSyntaxError.toString()});
+var jsonTokens = (${jsonTokens.toString()});
+var jsonIndent = (${jsonIndent.toString()});
+var COLORS = ${JSON.stringify(C)};
+var TOKEN = new URLSearchParams(location.search).get("t") || "";
+var TABS = ["Body", "Headers", "Response", "Raw"];
+
+var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Body", ended: false };
+var listSeq = 0, detailSeq = 0, msgTimer = null;
+var es = null, lost = false, replaying = false;
+function fail(e) { if (!state.ended) console.error(e); }
+
+function $(id) { return document.getElementById(id); }
+function el(tag, cls, text) {
+  var e = document.createElement(tag);
+  if (cls) e.className = cls;
+  if (text !== undefined && text !== null) e.textContent = String(text);
+  return e;
+}
+function clear(node) { while (node.firstChild) node.removeChild(node.firstChild); }
+
+function banner(text) {
+  var b = $("banner");
+  b.textContent = text || "";
+  b.hidden = !text;
+}
+function ended() {
+  state.ended = true;
+  banner("Session ended. Press i in duto to open the inspector again.");
+  if (es) es.close();
+}
+
+function api(path, method) {
+  return fetch(path, { method: method || "GET", headers: { "X-Duto-Inspector": TOKEN }, cache: "no-store" }).then(function (r) {
+    if (r.status === 403) { ended(); throw new Error("403"); }
+    return r.json().then(function (body) { return { status: r.status, body: body }; });
+  });
+}
+
+function statusInfo(it) {
+  if (it.status !== null && it.status !== undefined) {
+    var s = it.status;
+    var color = s >= 500 ? COLORS.err : s >= 400 ? COLORS.warn : s >= 300 ? COLORS.signal : COLORS.ok;
+    return { text: String(s), color: color };
+  }
+  if (it.error) return { text: "error", color: COLORS.err };
+  return { text: "…", color: COLORS.muted };
+}
+function duration(it) { return it.durationMs === null || it.durationMs === undefined ? "" : it.durationMs + " ms"; }
+function size(n) {
+  if (n < 1024) return n + " B";
+  if (n < 1024 * 1024) return (n / 1024).toFixed(1) + " KB";
+  return (n / 1024 / 1024).toFixed(1) + " MB";
+}
+function methodOf(it) { return it.websocket ? "WS" : it.method; }
+function header(h, name) {
+  for (var k in h) if (k.toLowerCase() === name) return h[k];
+  return "";
+}
+function visible() {
+  var f = $("filter").value.trim().toLowerCase();
+  if (!f) return state.items;
+  return state.items.filter(function (it) {
+    return (it.tunnel + " " + (it.websocket ? "ws" : it.method) + " " + it.path + " " + (it.status === null || it.status === undefined ? "" : it.status)).toLowerCase().indexOf(f) >= 0;
+  });
+}
+
+function renderTop() {
+  var n = state.items.length;
+  $("count").textContent = countLabel(n, "request", "requests");
+  var box = $("tunnels");
+  clear(box);
+  state.tunnels.forEach(function (t) {
+    var s = el("span");
+    s.appendChild(el("span", "k", t.key));
+    s.appendChild(document.createTextNode(" " + (t.url || "no URL yet")));
+    box.appendChild(s);
+  });
+}
+
+function renderList() {
+  var list = $("list");
+  var multi = state.tunnels.length > 1;
+  list.classList.toggle("multi", multi);
+  clear(list);
+  var items = visible();
+  if (items.length === 0) {
+    list.appendChild(el("div", "empty", state.items.length === 0 ? "No requests yet." : "No requests match the filter."));
+    return;
+  }
+  items.forEach(function (it) {
+    var row = el("div", "row" + (it.id === state.selected ? " sel" : ""));
+    row.setAttribute("role", "option");
+    row.setAttribute("aria-selected", it.id === state.selected ? "true" : "false");
+    row.dataset.id = String(it.id);
+    row.appendChild(el("span", "mut", it.replayOf !== undefined ? "↻" : ""));
+    if (multi) row.appendChild(el("span", "mut", it.tunnel));
+    row.appendChild(el("span", "m", methodOf(it)));
+    var p = el("span", "", it.path);
+    p.title = it.path;
+    row.appendChild(p);
+    var st = statusInfo(it);
+    var s = el("span", "", st.text);
+    s.style.color = st.color;
+    row.appendChild(s);
+    row.appendChild(el("span", "mut dur", duration(it)));
+    row.addEventListener("click", function () { select(it.id); });
+    list.appendChild(row);
+  });
+}
+
+function loadList() {
+  var seq = ++listSeq;
+  return Promise.all([api("/api/requests"), api("/api/session")]).then(function (rs) {
+    if (seq !== listSeq) return;
+    state.items = rs[0].body.items || [];
+    state.tunnels = rs[1].body.tunnels || [];
+    renderTop();
+    if (state.selected === null && state.items.length > 0) return select(state.items[0].id);
+    renderList();
+  }).catch(fail);
+}
+
+function select(id) {
+  if (state.selected !== id) {
+    state.selected = id;
+    state.detail = null;
+    state.detailKey = "";
+    hideMsg();
+  }
+  renderList();
+  var row = document.querySelector('.row[data-id="' + id + '"]');
+  if (row) row.scrollIntoView({ block: "nearest" });
+  return loadDetail(id);
+}
+
+function loadDetail(id) {
+  var seq = ++detailSeq;
+  return api("/api/requests/" + id).then(function (r) {
+    if (seq !== detailSeq || state.selected !== id) return;
+    var key = JSON.stringify(r.body);
+    if (key === state.detailKey) return;
+    state.detailKey = key;
+    state.detail = r.status === 200 ? r.body : null;
+    if (r.status !== 200) renderGone(r.body && r.body.error ? r.body.error : "That request is no longer in the list.");
+    else renderDetail();
+  }).catch(fail);
+}
+
+function renderGone(text) {
+  $("detail").hidden = true;
+  $("none").hidden = false;
+  $("none").textContent = text;
+}
+
+function renderDetail() {
+  var d = state.detail;
+  if (!d) return;
+  $("none").hidden = true;
+  $("detail").hidden = false;
+
+  var head = $("head");
+  clear(head);
+  head.appendChild(el("b", "", methodOf(d) + " " + d.path));
+  head.appendChild(document.createTextNode(" "));
+  var st = statusInfo(d);
+  var s = el("span", "", st.text);
+  s.style.color = st.color;
+  head.appendChild(s);
+  var parts = [];
+  if (duration(d)) parts.push(duration(d));
+  parts.push(size(d.bytes));
+  parts.push(d.tunnel);
+  if (d.replayOf !== undefined) parts.push("↻ replay of #" + d.replayOf);
+  head.appendChild(el("span", "mut", " · " + parts.join(" · ")));
+  if (d.error) head.appendChild(el("div", "msg err", d.error));
+
+  var tabs = document.querySelectorAll(".tab");
+  for (var i = 0; i < tabs.length; i++) {
+    var on = tabs[i].dataset.tab === state.tab;
+    tabs[i].classList.toggle("on", on);
+    tabs[i].setAttribute("aria-selected", on ? "true" : "false");
+  }
+  renderContent();
+  renderButtons();
+}
+
+function renderContent() {
+  var d = state.detail;
+  var box = $("content");
+  var top = box.scrollTop;
+  clear(box);
+  if (state.tab === "Body") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
+  else if (state.tab === "Headers") box.appendChild(table(d.reqHeaders));
+  else if (state.tab === "Response") {
+    box.appendChild(el("div", "sect", "Headers"));
+    box.appendChild(table(d.resHeaders));
+    box.appendChild(el("div", "sect", "Body"));
+    renderBody(box, d.resBody, d.resNote, d.resTruncatedNote, d.resHeaders);
+  } else {
+    var lines = [d.method + " " + d.path + " HTTP/1.1"];
+    for (var k in d.reqHeaders) lines.push(k + ": " + d.reqHeaders[k]);
+    lines.push("");
+    lines.push(d.reqNote !== null ? d.reqNote : d.reqBody || "");
+    box.appendChild(el("pre", "", lines.join("\n")));
+  }
+  box.scrollTop = top;
+}
+
+function table(h) {
+  var keys = Object.keys(h || {});
+  if (keys.length === 0) return el("div", "note", "No headers.");
+  var t = el("table");
+  keys.forEach(function (k) {
+    var tr = el("tr");
+    tr.appendChild(el("th", "", k));
+    tr.appendChild(el("td", "", h[k]));
+    t.appendChild(tr);
+  });
+  return t;
+}
+
+function renderBody(box, body, note, truncNote, headers) {
+  if (note !== null) {
+    box.appendChild(el("div", "note", note));
+    return;
+  }
+  if (body === null || body === undefined) {
+    box.appendChild(el("div", "note", "No body."));
+  } else if (header(headers, "content-type").toLowerCase().indexOf("json") >= 0) {
+    var err = jsonSyntaxError(body);
+    if (err === null) box.appendChild(jsonTree(jsonIndent(body)));
+    else {
+      box.appendChild(el("div", "jerr", err.message));
+      var pre = el("pre");
+      var at = Math.min(err.position, Math.max(0, body.length - 1));
+      pre.appendChild(document.createTextNode(body.slice(0, at)));
+      pre.appendChild(el("span", "bad", body.slice(at, at + 1) || " "));
+      pre.appendChild(document.createTextNode(body.slice(at + 1)));
+      box.appendChild(pre);
+    }
+  } else {
+    box.appendChild(el("pre", "", body));
+  }
+  if (truncNote !== null) box.appendChild(el("div", "trunc", truncNote));
+}
+
+var KIND = { key: "k", string: "s", number: "n", literal: "n", punct: "", space: "" };
+function jsonTree(text) {
+  var pre = el("pre");
+  var stack = [{ node: pre }];
+  jsonTokens(text).forEach(function (t) {
+    var top = stack[stack.length - 1];
+    if (top.wrap && t.kind !== "space" && !(t.kind === "punct" && (t.text === "}" || t.text === "]"))) top.has = true;
+    if (t.kind === "punct" && (t.text === "{" || t.text === "[")) {
+      var wrap = el("span", "fold");
+      var open = el("span", "open", t.text);
+      var inner = el("span", "inner");
+      var sum = el("span", "sum");
+      wrap.appendChild(open);
+      wrap.appendChild(inner);
+      wrap.appendChild(sum);
+      top.node.appendChild(wrap);
+      open.addEventListener("click", function () { if (wrap.dataset.n) wrap.classList.toggle("closed"); });
+      stack.push({ node: inner, wrap: wrap, open: open, sum: sum, depth: t.depth, obj: t.text === "{", count: 0, has: false });
+      return;
+    }
+    if (t.kind === "punct" && (t.text === "}" || t.text === "]") && stack.length > 1) {
+      var c = stack.pop();
+      var n = c.has ? c.count + 1 : 0;
+      if (n > 0) {
+        c.wrap.dataset.n = String(n);
+        c.open.title = "collapse or expand";
+        c.sum.textContent = " ▸ " + (c.obj ? countLabel(n, "field", "fields") : countLabel(n, "item", "items")) + " ";
+      } else c.open.className = "";
+      c.wrap.appendChild(document.createTextNode(t.text));
+      return;
+    }
+    if (top.wrap && t.kind === "punct" && t.text === "," && t.depth === top.depth + 1) top.count++;
+    var cls = KIND[t.kind];
+    top.node.appendChild(cls ? el("span", cls, t.text) : document.createTextNode(t.text));
+  });
+  return pre;
+}
+
+function renderButtons() {
+  var d = state.detail;
+  var replay = $("replay");
+  replay.disabled = d.replayBlocked !== null || replaying;
+  replay.title = d.replayBlocked || "";
+  replay.parentNode.title = d.replayBlocked || "";
+
+  var copyBody = $("copyBody");
+  var b = copyable(d);
+  copyBody.disabled = b.text === null;
+  copyBody.title = b.text === null ? b.note || "" : "";
+  copyBody.parentNode.title = copyBody.title;
+
+  var curl = $("copyCurl");
+  curl.disabled = d.curl === null;
+  curl.title = d.curl === null ? d.curlNote || "" : "";
+  curl.parentNode.title = curl.title;
+  var notes = [];
+  if (d.curl !== null && d.curlNote) notes.push(d.curlNote);
+  var tunnel = state.tunnels.filter(function (t) { return t.key === d.tunnel; })[0];
+  if (d.curl !== null && tunnel && tunnel.auth) notes.push("Replace PASSWORD with the tunnel password.");
+  $("curlNote").textContent = notes.join(" ");
+}
+function copyable(d) {
+  return state.tab === "Response" ? { text: d.resBody, note: d.resNote } : { text: d.reqBody, note: d.reqNote };
+}
+
+function showMsg(text, isErr) {
+  var m = $("msg");
+  m.textContent = text;
+  m.className = "msg" + (isErr ? " err" : "");
+  m.hidden = false;
+  if (msgTimer) clearTimeout(msgTimer);
+  msgTimer = null;
+}
+function hideMsg() {
+  if (msgTimer) clearTimeout(msgTimer);
+  msgTimer = null;
+  $("msg").hidden = true;
+}
+
+function copy(text) {
+  navigator.clipboard.writeText(text).then(function () {
+    showMsg("Copied.", false);
+    msgTimer = setTimeout(hideMsg, 2000);
+  }, function () {
+    showMsg("Could not copy.", true);
+  });
+}
+
+function replay() {
+  var d = state.detail;
+  if (!d || state.ended) return;
+  if (d.replayBlocked !== null) return showMsg(d.replayBlocked, true);
+  if (replaying) return;
+  replaying = true;
+  $("replay").disabled = true;
+  api("/api/requests/" + d.id + "/replay", "POST").then(function (r) {
+    replaying = false;
+    if (state.detail) renderButtons();
+    if (r.body && r.body.ok) {
+      hideMsg();
+      return loadList().then(function () { return select(r.body.id); });
+    }
+    showMsg(r.body && r.body.reason ? r.body.reason : "Could not replay.", true);
+  }).catch(function (e) {
+    replaying = false;
+    if (state.detail) renderButtons();
+    fail(e);
+  });
+}
+
+function move(delta) {
+  var items = visible();
+  if (items.length === 0) return;
+  var i = -1;
+  for (var j = 0; j < items.length; j++) if (items[j].id === state.selected) i = j;
+  var next = i < 0 ? 0 : Math.max(0, Math.min(items.length - 1, i + delta));
+  if (items[next].id !== state.selected) select(items[next].id);
+}
+
+function connect() {
+  if (state.ended) return;
+  es = new EventSource("/api/events?t=" + encodeURIComponent(TOKEN));
+  es.addEventListener("open", function () {
+    if (state.ended) return;
+    banner("");
+    if (lost) {
+      lost = false;
+      loadList();
+      if (state.selected !== null) loadDetail(state.selected);
+    }
+  });
+  es.addEventListener("error", function () {
+    if (state.ended) return;
+    lost = true;
+    banner("Disconnected from the session.");
+    if (es.readyState === 2) probe();
+  });
+  es.addEventListener("changed", function (ev) {
+    var ids = [];
+    try { ids = JSON.parse(ev.data).ids || []; } catch (e) {}
+    loadList();
+    if (state.selected !== null && (ids.length === 0 || ids.indexOf(state.selected) >= 0)) loadDetail(state.selected);
+  });
+}
+function probe() {
+  api("/api/session").then(function () {
+    if (!state.ended) setTimeout(connect, 3000);
+  }, function () {
+    if (!state.ended) setTimeout(connect, 3000);
+  });
+}
+
+function init() {
+  var tabs = document.querySelectorAll(".tab");
+  for (var i = 0; i < tabs.length; i++) {
+    tabs[i].addEventListener("click", function (ev) {
+      state.tab = ev.currentTarget.dataset.tab;
+      if (state.detail) renderDetail();
+    });
+  }
+  $("filter").addEventListener("input", renderList);
+  $("replay").addEventListener("click", replay);
+  $("copyBody").addEventListener("click", function () {
+    var b = state.detail ? copyable(state.detail) : { text: null };
+    if (b.text !== null && b.text !== undefined) copy(b.text);
+  });
+  $("copyCurl").addEventListener("click", function () { if (state.detail && state.detail.curl !== null) copy(state.detail.curl); });
+
+  document.addEventListener("keydown", function (ev) {
+    if (ev.ctrlKey || ev.metaKey || ev.altKey) return;
+    var inFilter = document.activeElement === $("filter");
+    if (ev.key === "ArrowDown" || ev.key === "ArrowUp") {
+      ev.preventDefault();
+      move(ev.key === "ArrowDown" ? 1 : -1);
+    } else if (ev.key === "Escape") {
+      if ($("filter").value) {
+        $("filter").value = "";
+        renderList();
+      }
+      if (inFilter) $("filter").blur();
+    } else if (ev.key === "/" && !inFilter) {
+      ev.preventDefault();
+      $("filter").focus();
+    } else if ((ev.key === "r" || ev.key === "R") && !inFilter && !ev.repeat) {
+      replay();
+    }
+  });
+
+  loadList();
+  connect();
+}
+
+init();
+`;
+function inspectorPage(nonce) {
+  const tabs = ["Body", "Headers", "Response", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>duto \xB7 inspector</title>
+<link rel="icon" href="data:,">
+<style nonce="${nonce}">${STYLE}</style>
+</head>
+<body>
+<div class="app">
+  <div class="top"><span><b>\u25B0 duto</b> \xB7 inspector \xB7 <span id="count">0 requests</span></span><span class="tunnels" id="tunnels"></span></div>
+  <div class="banner" id="banner" role="status" hidden></div>
+  <div class="main">
+    <div class="side">
+      <input class="search" id="filter" type="search" placeholder="filter\u2026" aria-label="Filter requests" autocomplete="off" spellcheck="false">
+      <div class="list" id="list" role="listbox" aria-label="Requests"></div>
+    </div>
+    <div class="detail">
+      <div class="empty" id="none">Select a request from the list.</div>
+      <div class="detail pane" id="detail" hidden>
+        <div class="head" id="head"></div>
+        <div class="tabs" role="tablist">${tabs}</div>
+        <div class="content" id="content"></div>
+        <div class="btns">
+          <span><button type="button" class="btn pri" id="replay">\u21BB Replay</button></span>
+          <span><button type="button" class="btn" id="copyBody">Copy body</button></span>
+          <span><button type="button" class="btn" id="copyCurl">Copy as curl</button></span>
+          <span class="msg" id="curlNote"></span>
+          <span class="msg" id="msg" role="status" hidden></span>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+<script nonce="${nonce}">${SCRIPT}</script>
+</body>
+</html>
+`;
+}
+
+// src/inspector/server.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// src/session/replay.ts
+var tunnelClosedReason = (tunnel2) => `Tunnel ${tunnel2} is not open in this session.`;
+function replayBlock(r) {
+  if (!r) return "That request is no longer in the list.";
+  if (r.websocket) return "WebSocket requests cannot be replayed.";
+  if (r.noReplay) return r.noReplay;
+  if (r.access?.kind === "denied") return "Blocked by the tunnel password; cannot replay.";
+  if (!r.reqComplete) return "The request has not fully arrived yet.";
+  if (r.reqTruncated) return "Body over 64 KB; cannot replay.";
+  if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Binary body is not stored; cannot replay.";
+  return null;
+}
+var HOP_BY_HOP_AND_BODY_HEADERS = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
+function replayHeaders(r) {
+  const out = {};
+  for (const [k, v] of Object.entries(r.reqHeaders)) if (!HOP_BY_HOP_AND_BODY_HEADERS.has(k.toLowerCase())) out[k] = v;
+  const hadLength = Object.keys(r.reqHeaders).some((k) => k.toLowerCase() === "content-length");
+  if (r.reqBodyBytes > 0 || hadLength) out["content-length"] = String(r.reqRaw?.length ?? 0);
+  return out;
+}
+
+// src/inspector/curl.ts
+var SKIP = /* @__PURE__ */ new Set(["host", "content-length", "transfer-encoding", "connection", "keep-alive", "expect", "upgrade", "te", "trailer", "proxy-connection"]);
+var TUNNEL_ADDED = /* @__PURE__ */ new Set(["cdn-loop", "x-forwarded-for", "x-forwarded-proto", "x-real-ip", "true-client-ip"]);
+var skip = (name) => {
+  const k = name.toLowerCase();
+  return SKIP.has(k) || TUNNEL_ADDED.has(k) || k.startsWith("cf-");
+};
+function shellQuote(s) {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+function toCurl(r, o) {
+  const parts = [`curl -X ${shellQuote(r.method)} ${shellQuote(o.publicUrl.replace(/\/+$/, "") + r.path)}`];
+  for (const [k, v] of Object.entries(r.reqHeaders)) {
+    if (!skip(k)) parts.push(`-H ${shellQuote(`${k}: ${v}`)}`);
+  }
+  if (o.authUser !== null) parts.push(`-H ${shellQuote(`X-Duto-Auth: ${o.authUser}:PASSWORD`)}`);
+  if (r.reqBody !== null) parts.push(`--data-binary ${shellQuote(r.reqBody)}`);
+  return parts.join(" \\\n  ");
+}
+
+// src/inspector/server.ts
+var DEFAULT_PORT = 4141;
+var PORT_TRIES = 20;
+var NO_TOKEN = "Open the inspector with the i key in the duto screen, or with the address printed in the terminal.";
+var GONE = "That request is no longer in the list.";
+var NO_URL = "The tunnel has no public URL yet.";
+var CURL_BYTES = "The curl body may differ from the one received (non-UTF-8 bytes).";
+var sha = (s) => createHash2("sha256").update(s).digest();
+var constantTimeEqual = (a, b) => timingSafeEqual(sha(a), sha(b));
+var first = (v) => Array.isArray(v) ? v[0] : v;
+function listItem(r) {
+  return {
+    id: r.id,
+    tunnel: r.tunnel,
+    method: r.method,
+    path: r.path,
+    status: r.status,
+    durationMs: r.durationMs,
+    bytes: r.bytes,
+    startedAt: r.startedAt,
+    websocket: r.websocket,
+    ...r.replayOf !== void 0 && { replayOf: r.replayOf },
+    ...r.error !== void 0 && { error: r.error }
+  };
+}
+function detail(r, session) {
+  const tunnel2 = session.getState().tunnels.find((t) => t.key === r.tunnel);
+  const tunnelOpen = !!tunnel2 && (tunnel2.status === "live" || tunnel2.status === "no-listener");
+  let curl = null;
+  let curlNote = null;
+  if (!tunnel2?.url) curlNote = NO_URL;
+  else {
+    curl = toCurl(r, { publicUrl: tunnel2.url, authUser: session.authUser(r.tunnel) });
+    if (r.reqRaw && !Buffer.from(r.reqBody ?? "", "utf8").equals(r.reqRaw)) curlNote = CURL_BYTES;
+  }
+  return {
+    ...listItem(r),
+    reqHeaders: r.reqHeaders,
+    resHeaders: r.resHeaders,
+    reqBody: r.reqBody,
+    resBody: r.resBody,
+    reqNote: bodyNote(r, "req"),
+    resNote: bodyNote(r, "res"),
+    reqTruncatedNote: r.reqTruncated ? TRUNCATED_NOTE : null,
+    resTruncatedNote: r.resTruncated ? TRUNCATED_NOTE : null,
+    replayBlocked: replayBlock(r) ?? (tunnelOpen ? null : tunnelClosedReason(r.tunnel)),
+    curl,
+    curlNote
+  };
+}
+var sig = (r) => `${r.status}|${r.durationMs}|${r.bytes}|${r.resBody?.length ?? -1}|${r.reqComplete}|${r.error ?? ""}|${Object.keys(r.resHeaders).length > 0}`;
+async function startInspector(o) {
+  const { session } = o;
+  const eventMs = o.eventMs ?? 150;
+  const pingMs = o.pingMs ?? 25e3;
+  const token = randomBytes(24).toString("base64url");
+  let port = 0;
+  const clients = /* @__PURE__ */ new Set();
+  let seen = /* @__PURE__ */ new Map();
+  let timer = null;
+  const prime = () => seen = new Map(session.records.list().map((r) => [r.id, sig(r)]));
+  const flush = () => {
+    timer = null;
+    const next = /* @__PURE__ */ new Map();
+    const ids = [];
+    for (const r of session.records.list()) {
+      const s = sig(r);
+      next.set(r.id, s);
+      if (seen.get(r.id) !== s) ids.push(r.id);
+    }
+    seen = next;
+    const msg = `event: changed
+data: ${JSON.stringify({ ids })}
+
+`;
+    for (const c of clients) c.write(msg);
+  };
+  const schedule = () => {
+    if (clients.size > 0 && !timer) timer = setTimeout(flush, eventMs);
+  };
+  const unsubs = [session.records.subscribe(schedule), session.subscribe(schedule)];
+  const pinger = setInterval(() => {
+    for (const c of clients) c.write(": ping\n\n");
+  }, pingMs);
+  pinger.unref();
+  const base = (res) => {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-Frame-Options", "DENY");
+  };
+  const text = (res, status, body) => {
+    res.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end(body);
+  };
+  const json = (res, status, body) => {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(JSON.stringify(body));
+  };
+  const handle = (req, res) => {
+    base(res);
+    const host = first(req.headers.host)?.toLowerCase();
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text(res, 403, "Host not allowed.");
+    let url2;
+    try {
+      url2 = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+    } catch {
+      return text(res, 404, "Not found.");
+    }
+    const path = url2.pathname;
+    const method = req.method ?? "GET";
+    const queryToken = url2.searchParams.get("t") ?? "";
+    const headerToken = first(req.headers["x-duto-inspector"]) ?? "";
+    if (method === "GET" && path === "/") {
+      if (!constantTimeEqual(queryToken, token)) return text(res, 403, NO_TOKEN);
+      const nonce = randomBytes(16).toString("base64url");
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Content-Security-Policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`
+      });
+      return void res.end(o.page(nonce));
+    }
+    const isEvents = method === "GET" && path === "/api/events";
+    const detailId = /^\/api\/requests\/([1-9]\d{0,15})(\/replay)?$/.exec(path);
+    const known = method === "GET" && (path === "/api/session" || path === "/api/requests" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
+    if (!known) return text(res, 404, "Not found.");
+    if (!constantTimeEqual(headerToken, token) && !(isEvents && constantTimeEqual(queryToken, token))) return json(res, 403, { error: NO_TOKEN });
+    if (isEvents) {
+      res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", Connection: "keep-alive" });
+      res.write(": duto\n\n");
+      if (clients.size === 0) prime();
+      clients.add(res);
+      res.on("close", () => clients.delete(res));
+      return;
+    }
+    if (path === "/api/session") {
+      return json(res, 200, { tunnels: session.getState().tunnels.map((t) => ({ key: t.key, url: t.url, auth: !!t.auth })) });
+    }
+    if (path === "/api/requests") return json(res, 200, { items: session.records.list().map(listItem) });
+    const id = Number(detailId[1]);
+    if (!Number.isSafeInteger(id)) return json(res, 404, { error: GONE });
+    if (method === "POST") return json(res, 200, session.replay(id));
+    const r = session.records.get(id);
+    if (!r) return json(res, 404, { error: GONE });
+    return json(res, 200, detail(r, session));
+  };
+  const server = createServer((req, res) => {
+    try {
+      handle(req, res);
+    } catch {
+      if (!res.headersSent) text(res, 500, "Internal error.");
+      else res.end();
+    }
+  });
+  const listen = (p) => new Promise((resolve, reject) => {
+    const onError = (e) => reject(e);
+    server.once("error", onError);
+    server.listen(p, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  const want = o.port ?? DEFAULT_PORT;
+  try {
+    let bound = false;
+    if (want !== 0) {
+      for (let p = want; p <= want + PORT_TRIES && !bound; p++) {
+        try {
+          await listen(p);
+          bound = true;
+        } catch (e) {
+          if (e.code !== "EADDRINUSE") throw e;
+        }
+      }
+    }
+    if (!bound) await listen(0);
+  } catch (e) {
+    for (const u of unsubs) u();
+    clearInterval(pinger);
+    throw e;
+  }
+  port = server.address().port;
+  const url = `http://127.0.0.1:${port}`;
+  return {
+    port,
+    url,
+    openUrl: `${url}/?t=${token}`,
+    close: () => new Promise((resolve) => {
+      for (const u of unsubs) u();
+      clearInterval(pinger);
+      if (timer) clearTimeout(timer);
+      for (const c of clients) c.end();
+      clients.clear();
+      server.close(() => resolve());
+      server.closeAllConnections();
+    })
+  };
+}
+
 // src/session/session.ts
 import { spawn } from "child_process";
 
@@ -540,11 +1453,12 @@ async function isPortListening(port, timeoutMs = 500) {
 }
 
 // src/session/auth.ts
-import { createHash as createHash2, createHmac, randomBytes, timingSafeEqual } from "crypto";
-var TUNNEL_COOKIE = "__Host-duto_tunel";
+import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var TUNNEL_COOKIE = "__Host-duto_tunnel";
+var SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED = "same-site";
 var QR_TTL_MS = 5 * 6e4;
-var sha = (s) => createHash2("sha256").update(s).digest();
-var same = (a, b) => timingSafeEqual(sha(a), sha(b));
+var sha2 = (s) => createHash3("sha256").update(s).digest();
+var constantTimeEqual2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
 function splitPair(raw) {
   const i = raw.indexOf(":");
   return i < 0 ? null : { user: raw.slice(0, i), password: raw.slice(i + 1) };
@@ -553,11 +1467,11 @@ function parseBasic(value) {
   const m = /^basic +([A-Za-z0-9+/]+={0,2})$/i.exec(value?.trim() ?? "");
   return m ? splitPair(Buffer.from(m[1], "base64").toString("utf8")) : null;
 }
-var first = (v) => Array.isArray(v) ? v[0] : v;
+var first2 = (v) => Array.isArray(v) ? v[0] : v;
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
-  if (first(h["sec-fetch-site"])?.toLowerCase() === "same-site") return false;
-  const origin = first(h.origin);
+  if (first2(h["sec-fetch-site"])?.toLowerCase() === SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED) return false;
+  const origin = first2(h.origin);
   if (origin === void 0) return true;
   let host;
   try {
@@ -580,27 +1494,27 @@ var TunnelAuth = class {
     this.credentials = o.credentials;
     this.allow = o.allow;
     this.now = o.now ?? Date.now;
-    this.secret = o.secret ?? randomBytes(32);
+    this.secret = o.secret ?? randomBytes2(32);
     this.qrUser = o.credentials[0]?.user ?? "";
   }
   access(h) {
     if (this.allow) {
-      const ip = first(h["cf-connecting-ip"]);
+      const ip = first2(h["cf-connecting-ip"]);
       const reason = this.allow.match(ip);
       if (reason) return { kind: "allow", reason };
     }
     const cookieUser = this.cookieUser(h.cookie);
     if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
-    const duto = first(h["x-duto-auth"]);
-    const cand = duto !== void 0 ? splitPair(duto) : parseBasic(first(h.authorization));
-    if (cand && this.checkPassword(cand.user, cand.password)) return { kind: "user", user: cand.user };
+    const dutoAuthHeader = first2(h["x-duto-auth"]);
+    const candidate = dutoAuthHeader !== void 0 ? splitPair(dutoAuthHeader) : parseBasic(first2(h.authorization));
+    if (candidate && this.checkPassword(candidate.user, candidate.password)) return { kind: "user", user: candidate.user };
     return { kind: "denied" };
   }
   checkPassword(user, password) {
     let ok2 = false;
     for (const c of this.credentials) {
-      const userOk = same(c.user, user);
-      const passOk = same(c.password, password);
+      const userOk = constantTimeEqual2(c.user, user);
+      const passOk = constantTimeEqual2(c.password, password);
       if (userOk && passOk) ok2 = true;
     }
     return ok2;
@@ -612,19 +1526,19 @@ var TunnelAuth = class {
     return `${TUNNEL_COOKIE}=; Max-Age=0; Secure; HttpOnly; SameSite=Lax; Path=/`;
   }
   issueQrToken() {
-    this.qr = { token: randomBytes(24).toString("base64url"), expiresAt: this.now() + QR_TTL_MS };
+    this.qr = { token: randomBytes2(24).toString("base64url"), expiresAt: this.now() + QR_TTL_MS };
     return { ...this.qr };
   }
   consumeQrToken(token) {
     const qr = this.qr;
-    if (!qr || !same(qr.token, token)) return false;
+    if (!qr || !constantTimeEqual2(qr.token, token)) return false;
     this.qr = null;
     return this.now() <= qr.expiresAt;
   }
   strip(h) {
     const out = { ...h };
     delete out["x-duto-auth"];
-    const basic = parseBasic(first(h.authorization));
+    const basic = parseBasic(first2(h.authorization));
     if (basic && this.checkPassword(basic.user, basic.password)) delete out.authorization;
     if (h.cookie !== void 0) {
       const parts = (Array.isArray(h.cookie) ? h.cookie.join("; ") : h.cookie).split(";").map((p) => p.trim()).filter(Boolean);
@@ -635,7 +1549,6 @@ var TunnelAuth = class {
     }
     return out;
   }
-  // Valor: usuário em base64url + "." + HMAC(túnel, usuário).
   cookieValue(user) {
     return `${Buffer.from(user).toString("base64url")}.${this.sign(user)}`;
   }
@@ -648,10 +1561,10 @@ var TunnelAuth = class {
     for (const p of list) {
       const item = p.trim();
       if (!item.startsWith(`${TUNNEL_COOKIE}=`)) continue;
-      const [b64, sig, ...resto] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
-      if (!b64 || !sig || resto.length) continue;
+      const [b64, sig2, ...extra] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
+      if (!b64 || !sig2 || extra.length) continue;
       const user = Buffer.from(b64, "base64url").toString("utf8");
-      if (same(sig, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
+      if (constantTimeEqual2(sig2, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
     }
     return null;
   }
@@ -682,7 +1595,7 @@ function cors401(origin) {
 }
 
 // src/session/proxy.ts
-import { Agent, createServer, request } from "http";
+import { Agent, createServer as createServer2, request } from "http";
 import { connect as connect2 } from "net";
 
 // src/session/errorPage.ts
@@ -703,14 +1616,14 @@ var WAIT_SCRIPT = `
   }
   function again() { delay = Math.min(delay * 2, 30000); poll(); }
   if (!window.EventSource) return poll();
-  var fails = 0, es = new EventSource("/__duto/espera");
+  var fails = 0, es = new EventSource("/__duto/wait");
   es.addEventListener("up", function () { es.close(); location.reload(); });
   es.onerror = function () { if (++fails >= 3) { es.close(); poll(); } };
 })();
 </script>`;
 function pageShell(title, body, css = "") {
   return `<!doctype html>
-<html lang="pt-BR">
+<html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -742,13 +1655,13 @@ function unavailablePage(o) {
   const tunnel2 = esc(o.tunnel);
   const local = `localhost:${o.port}`;
   return pageShell(
-    `Nada respondendo em ${local} \xB7 duto`,
+    `Nothing responding on ${local} \xB7 duto`,
     `<main>
 <div class="mark"><span class="dot"></span>duto \xB7 ${tunnel2}</div>
-<h1>Nada respondendo em <code>${local}</code></h1>
-<p>O t\xFAnel <code>${tunnel2}</code> est\xE1 no ar, mas o servi\xE7o local n\xE3o respondeu. Suba o servidor na m\xE1quina que abriu o t\xFAnel.</p>
-<p>Se voc\xEA s\xF3 recebeu este link, avise quem o enviou.</p>
-<div class="retry">${o.retry ? `<b>Aguardando o servi\xE7o.</b> A p\xE1gina volta sozinha quando ele responder.<noscript> Recarregue quando o servi\xE7o estiver no ar.</noscript>` : "Recarregue a p\xE1gina quando o servi\xE7o estiver no ar."}</div>
+<h1>Nothing is responding on <code>${local}</code></h1>
+<p>The tunnel <code>${tunnel2}</code> is live, but your local service did not respond. Start the server on the machine that opened the tunnel.</p>
+<p>If you were only sent this link, let whoever shared it know.</p>
+<div class="retry">${o.retry ? `<b>Waiting for the service.</b> This page reloads when it responds.<noscript> Reload once the service is up.</noscript>` : "Reload the page once the service is up."}</div>
 </main>${o.retry ? WAIT_SCRIPT : ""}`
   );
 }
@@ -761,56 +1674,36 @@ button{margin-top:18px;width:100%;padding:10px;border:0;border-radius:.3rem;back
 .error{margin:14px 0 0;color:#b42318;font-weight:600}
 @media (prefers-color-scheme:dark){.error{color:#f97066}}
 `;
-function safeVolta(raw) {
+function safeNext(raw) {
   if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
   return /^[\x21-\x7e]+$/.test(raw) ? raw : "/";
 }
 function loginPage(o) {
   return pageShell(
-    "Entrar \xB7 duto",
+    "Sign in \xB7 duto",
     `<main>
 <div class="mark"><span class="dot"></span>duto \xB7 ${esc(o.tunnel)}</div>
-<h1>Este t\xFAnel tem senha</h1>
-<p>Pe\xE7a o acesso a quem enviou o link.</p>
-<form method="post" action="/__duto/entrar">
-<input type="hidden" name="volta" value="${esc(o.volta)}">
-<label for="usuario">Usu\xE1rio</label>
-<input id="usuario" name="usuario" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
-<label for="senha">Senha</label>
-<input id="senha" name="senha" type="password" autocomplete="current-password" required>
-${o.error ? `<p class="error" role="alert">Usu\xE1rio ou senha incorretos.</p>
-` : ""}<button type="submit">Entrar</button>
+<h1>This tunnel is password protected</h1>
+<p>Ask whoever sent you the link for access.</p>
+<form method="post" action="/__duto/login">
+<input type="hidden" name="next" value="${esc(o.next)}">
+<label for="username">Username</label>
+<input id="username" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
+<label for="password">Password</label>
+<input id="password" name="password" type="password" autocomplete="current-password" required>
+${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
+` : ""}<button type="submit">Sign in</button>
 </form>
-<div class="retry">Voc\xEA continua conectado at\xE9 o t\xFAnel fechar.</div>
+<div class="retry">You stay signed in until the tunnel closes.</div>
 </main>`,
     CSS
   );
 }
 
-// src/session/replay.ts
-function replayBlock(r) {
-  if (!r) return "Essa requisi\xE7\xE3o j\xE1 saiu da lista.";
-  if (r.websocket) return "WebSocket n\xE3o d\xE1 para reenviar.";
-  if (r.noReplay) return r.noReplay;
-  if (r.access?.kind === "denied") return "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
-  if (!r.reqComplete) return "A requisi\xE7\xE3o ainda n\xE3o chegou inteira.";
-  if (r.reqTruncated) return "Corpo acima de 64 KB; n\xE3o d\xE1 para reenviar.";
-  if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Corpo bin\xE1rio n\xE3o \xE9 guardado; n\xE3o d\xE1 para reenviar.";
-  return null;
-}
-var DROP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
-function replayHeaders(r) {
-  const out = {};
-  for (const [k, v] of Object.entries(r.reqHeaders)) if (!DROP.has(k.toLowerCase())) out[k] = v;
-  const hadLength = Object.keys(r.reqHeaders).some((k) => k.toLowerCase() === "content-length");
-  if (r.reqBodyBytes > 0 || hadLength) out["content-length"] = String(r.reqRaw?.length ?? 0);
-  return out;
-}
-
 // src/session/proxy.ts
-var DENIED_NO_REPLAY = "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
-var PREFLIGHT_NO_REPLAY = "Preflight de CORS n\xE3o d\xE1 para reenviar.";
-var TEXT = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
+var DENIED_NO_REPLAY = "Blocked by the tunnel password; cannot replay.";
+var PREFLIGHT_NO_REPLAY = "CORS preflight cannot be replayed.";
+var TEXT2 = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
 var MAX_BODY = 64 * 1024;
 var LOCAL_AGENT = new Agent({ keepAlive: false });
 function flat(h) {
@@ -827,7 +1720,6 @@ var Capture = class {
   max;
   chunks = [];
   size = 0;
-  /** Bytes vistos, capturados ou não. */
   total = 0;
   truncated = false;
   push(c) {
@@ -850,6 +1742,7 @@ var Capture = class {
     return this.enabled && this.size > 0 ? Buffer.concat(this.chunks).toString("utf8") : null;
   }
 };
+var HOST_CACHE_MS = 5e3;
 var hostCache = /* @__PURE__ */ new Map();
 function probe(host, port) {
   return new Promise((resolve) => {
@@ -865,7 +1758,7 @@ function probe(host, port) {
 }
 async function localHost(port) {
   const hit = hostCache.get(port);
-  if (hit && Date.now() - hit.at < 5e3) return hit.host;
+  if (hit && Date.now() - hit.at < HOST_CACHE_MS) return hit.host;
   const host = await probe("127.0.0.1", port) ? "127.0.0.1" : await probe("::1", port) ? "::1" : null;
   if (!host) return "127.0.0.1";
   hostCache.set(port, { host, at: Date.now() });
@@ -894,13 +1787,16 @@ function hostOf(req) {
   return (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
 }
 var DUTO_PREFIX = "/__duto/";
-var WAIT_PATH = "/__duto/espera";
+var WAIT_PATH = "/__duto/wait";
 var WAIT_MAX_MS = 10 * 6e4;
-var LOGIN_PATH = "/__duto/entrar";
-var LOGOUT_PATH = "/__duto/sair";
+var DEFAULT_ROUTE_WAIT_MS = 3e3;
+var DEFAULT_WAIT_CHECK_MS = 1e3;
+var SSE_KEEPALIVE_MS = 25e3;
+var LOGIN_PATH = "/__duto/login";
+var LOGOUT_PATH = "/__duto/logout";
 var QR_PREFIX = "/__duto/qr/";
 var MAX_FORM = 8 * 1024;
-var DENIED_TEXT = "Este t\xFAnel tem senha. Envie Authorization: Basic ou X-Duto-Auth: usuario:senha.";
+var DENIED_TEXT = "This tunnel is password protected. Send Authorization: Basic or X-Duto-Auth: user:password.";
 var WS_DENIED = 'HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm="duto"\r\nContent-Length: 0\r\nConnection: close\r\n\r\n';
 function readForm(req, max) {
   return new Promise((resolve) => {
@@ -923,9 +1819,9 @@ function readForm(req, max) {
 }
 async function authRoute(req, res, route, auth) {
   const url = new URL(req.url ?? "/", "http://duto");
-  const page = (status, volta, error) => {
+  const page = (status, next, error) => {
     res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
-    res.end(loginPage({ tunnel: route.tunnel, volta, error }));
+    res.end(loginPage({ tunnel: route.tunnel, next, error }));
   };
   const go = (location, cookie) => {
     res.writeHead(303, { location, "cache-control": "no-store", ...cookie && { "set-cookie": cookie } });
@@ -933,21 +1829,21 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeVolta(url.searchParams.get("volta")), false);
+    page(200, safeNext(url.searchParams.get("next")), false);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
     const raw = await readForm(req, MAX_FORM);
     if (raw === null) {
       res.writeHead(413, { "content-type": "text/plain; charset=utf-8", connection: "close" });
-      res.end("Formul\xE1rio grande demais");
+      res.end("Form too large");
       return true;
     }
     const form = new URLSearchParams(raw);
-    const user = form.get("usuario") ?? "";
-    const volta = safeVolta(form.get("volta"));
-    if (auth.checkPassword(user, form.get("senha") ?? "")) go(volta, auth.loginCookie(user));
-    else page(401, volta, true);
+    const user = form.get("username") ?? "";
+    const next = safeNext(form.get("next"));
+    if (auth.checkPassword(user, form.get("password") ?? "")) go(next, auth.loginCookie(user));
+    else page(401, next, true);
     return true;
   }
   if (pathname === LOGOUT_PATH && req.method === "GET") {
@@ -963,7 +1859,7 @@ async function authRoute(req, res, route, auth) {
 }
 function deny(req, res, html) {
   const status = html ? 303 : 401;
-  const out = html ? { location: `${LOGIN_PATH}?volta=${encodeURIComponent(req.url ?? "/")}`, "cache-control": "no-store" } : { "www-authenticate": 'Basic realm="duto"', "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...cors401(req.headers.origin) };
+  const out = html ? { location: `${LOGIN_PATH}?next=${encodeURIComponent(req.url ?? "/")}`, "cache-control": "no-store" } : { "www-authenticate": 'Basic realm="duto"', "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...cors401(req.headers.origin) };
   const body = html || req.method === "HEAD" ? "" : DENIED_TEXT;
   res.writeHead(status, out);
   res.end(body);
@@ -1005,7 +1901,7 @@ function waitForService(res, port, checkMs, pingMs) {
 async function startProxy(o) {
   const max = o.maxBody ?? MAX_BODY;
   let nextId = 1;
-  const routeWaitMs = o.routeWaitMs ?? 3e3;
+  const routeWaitMs = o.routeWaitMs ?? DEFAULT_ROUTE_WAIT_MS;
   async function routeFor(req) {
     const host = hostOf(req);
     for (let waited = 0; ; waited += 50) {
@@ -1043,7 +1939,7 @@ async function startProxy(o) {
     return { id, started };
   }
   function trackResponse(id, started, up, reqCap) {
-    const resCap = new Capture(TEXT.test(up.headers["content-type"] ?? ""), max);
+    const resCap = new Capture(TEXT2.test(up.headers["content-type"] ?? ""), max);
     let bytes = 0;
     up.on("data", (c) => {
       bytes += c.length;
@@ -1066,9 +1962,9 @@ async function startProxy(o) {
   function replay(id) {
     const r = o.store.get(id);
     const blocked = replayBlock(r);
-    if (blocked || !r) return { ok: false, reason: blocked ?? "Essa requisi\xE7\xE3o j\xE1 saiu da lista." };
+    if (blocked || !r) return { ok: false, reason: blocked ?? "That request is no longer in the list." };
     const route = [...o.routes.values()].find((x) => x.tunnel === r.tunnel);
-    if (!route) return { ok: false, reason: `O t\xFAnel ${r.tunnel} n\xE3o est\xE1 aberto nesta sess\xE3o.` };
+    if (!route) return { ok: false, reason: tunnelClosedReason(r.tunnel) };
     const newId = nextId++;
     const started = Date.now();
     const headers = replayHeaders(r);
@@ -1102,22 +1998,22 @@ async function startProxy(o) {
     })();
     return { ok: true, id: newId };
   }
-  const server = createServer(async (req, res) => {
+  const server = createServer2(async (req, res) => {
     req.pause();
     const route = await routeFor(req);
     if (!route) {
       res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("T\xFAnel n\xE3o encontrado nesta sess\xE3o");
+      res.end("Tunnel not found in this session");
       return;
     }
     if ((req.url ?? "").startsWith(DUTO_PREFIX)) {
       if (req.url === WAIT_PATH && req.method === "GET") {
         if (route.auth?.access(req.headers).kind === "denied") return void deny(req, res, false);
-        return waitForService(res, route.port, o.waitCheckMs ?? 1e3, o.waitPingMs ?? 25e3);
+        return waitForService(res, route.port, o.waitCheckMs ?? DEFAULT_WAIT_CHECK_MS, o.waitPingMs ?? SSE_KEEPALIVE_MS);
       }
       if (route.auth && await authRoute(req, res, route, route.auth)) return;
       res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("Rota reservada do Duto");
+      res.end("Reserved Duto route");
       return;
     }
     const preflight = !!route.auth && isPreflight(req.method, req.headers);
@@ -1131,7 +2027,7 @@ async function startProxy(o) {
       return;
     }
     const { id, started } = record(req, route, headers, false, access, preflight ? PREFLIGHT_NO_REPLAY : void 0);
-    const reqCap = new Capture(TEXT.test(req.headers["content-type"] ?? ""), max);
+    const reqCap = new Capture(TEXT2.test(req.headers["content-type"] ?? ""), max);
     req.pause();
     const host = await localHost(route.port);
     const upstream = request(
@@ -1160,7 +2056,7 @@ async function startProxy(o) {
       req.resume();
       if (res.destroyed && res.writableFinished === false && !res.headersSent) return;
       const html = wantsHtml(req.headers.accept);
-      const msg = html ? unavailablePage({ tunnel: route.tunnel, port: route.port, retry: req.method === "GET" }) : `Nada escutando em localhost:${route.port}. Suba o servidor e tente de novo.`;
+      const msg = html ? unavailablePage({ tunnel: route.tunnel, port: route.port, retry: req.method === "GET" }) : `Nothing is listening on localhost:${route.port}. Start the server and try again.`;
       if (!res.headersSent) {
         res.writeHead(503, { "content-type": html ? "text/html; charset=utf-8" : "text/plain; charset=utf-8", "cache-control": "no-store", "retry-after": "3" });
         res.end(req.method === "HEAD" ? void 0 : msg);
@@ -1201,8 +2097,8 @@ async function startProxy(o) {
       target.write(`${raw}\r
 `);
       if (head.length) target.write(head);
-      target.once("data", (first2) => {
-        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first2.toString("latin1"))?.[1] ?? 0) || null;
+      target.once("data", (first3) => {
+        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first3.toString("latin1"))?.[1] ?? 0) || null;
         o.store.update(id, { status, durationMs: Date.now() - started });
       });
       target.pipe(client);
@@ -1324,7 +2220,6 @@ var RecordStore = class {
   get(id) {
     return this.items.find((x) => x.id === id);
   }
-  /** Mais recentes primeiro. Mesma referência até a próxima mudança (serve de snapshot para a tela). */
   list() {
     this.snapshot ??= [...this.items].reverse();
     return this.snapshot;
@@ -1344,8 +2239,8 @@ var READY = "Registered tunnel connection";
 var CLOSE_TIMEOUT_MS = 3e3;
 var HEARTBEAT_MS = 3e4;
 var RESTART_CF_MS = 2e3;
-var ALREADY_OPEN = "J\xE1 aberto em outra sess\xE3o nesta m\xE1quina";
-var STALE_MS = 75e3;
+var ALREADY_OPEN = "Already open in another session on this machine";
+var STALE_AFTER_MISSED_HEARTBEATS_MS = 75e3;
 function message(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1353,7 +2248,7 @@ function withTimeout(p, ms) {
   return Promise.race([p, new Promise((r) => setTimeout(() => r(void 0), ms).unref())]);
 }
 function keyOf(spec) {
-  return spec.name ?? "(padr\xE3o)";
+  return spec.name ?? "(default)";
 }
 var Session = class {
   constructor(o) {
@@ -1365,8 +2260,7 @@ var Session = class {
   tunnels = [];
   routes = /* @__PURE__ */ new Map();
   specs = /* @__PURE__ */ new Map();
-  /** Um TunnelAuth por túnel, reaproveitado nas reaberturas para não desconectar quem já entrou. */
-  auths = /* @__PURE__ */ new Map();
+  persistentAuths = /* @__PURE__ */ new Map();
   proxy = null;
   child = null;
   token = null;
@@ -1377,7 +2271,6 @@ var Session = class {
   connection = "connecting";
   listeners = /* @__PURE__ */ new Set();
   snapshot = null;
-  /** Mesma referência até a próxima mudança (serve de snapshot para a tela). */
   getState() {
     this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })) };
     return this.snapshot;
@@ -1386,23 +2279,18 @@ var Session = class {
     this.listeners.add(fn);
     return () => this.listeners.delete(fn);
   }
-  /** Abre os túneis em sequência; falhas ficam no estado e não interrompem os outros. */
   async start(specs) {
     if (this.o.runDir) reapOrphans(this.o.runDir);
     this.proxy = await startProxy({ routes: this.routes, store: this.records });
     this.tunnels = specs.map((s) => this.blank(s, false));
     this.emit();
-    try {
-      const me = await this.o.api.me();
-      this.account = me.username ?? me.email;
-    } catch {
-    }
+    const me = await this.o.api.me().catch(() => null);
+    if (me) this.account = me.username ?? me.email;
     const existing = await this.o.api.endpoints().catch(() => []);
     for (const t of this.tunnels) await this.open(t, existing);
     const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
     this.timer = setInterval(() => void this.beat(), every);
   }
-  /** Túnel avulso, só nesta sessão. */
   async add(spec) {
     if (this.tunnels.some((t2) => t2.key === keyOf(spec))) return;
     const t = this.blank(spec, true);
@@ -1411,29 +2299,29 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
-  /** Link para o QR: com senha, um token de uso único; sem senha, só a URL. */
   qrLink(key) {
     const t = this.tunnels.find((x) => x.key === key);
     if (!t?.url) return null;
-    const auth = this.auths.get(key);
+    const auth = this.persistentAuths.get(key);
     if (!auth) return { url: t.url, expiresAt: null };
     const { token, expiresAt } = auth.issueQrToken();
     return { url: `${t.url}/__duto/qr/${token}`, expiresAt };
   }
-  /** Cria o TunnelAuth na primeira abertura (precisa do allow resolvido) e o mantém depois. */
+  authUser(key) {
+    return this.persistentAuths.get(key)?.qrUser ?? null;
+  }
   async authFor(key) {
-    const existing = this.auths.get(key);
+    const existing = this.persistentAuths.get(key);
     if (existing) return existing;
     const spec = this.specs.get(key);
     if (!spec?.auth?.length) return void 0;
     const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
     const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
-    this.auths.set(key, auth);
+    this.persistentAuths.set(key, auth);
     return auth;
   }
-  /** Reenvia uma requisição da lista ao serviço local. */
   replay(id) {
-    return this.proxy ? this.proxy.replay(id) : { ok: false, reason: "Sess\xE3o ainda n\xE3o come\xE7ou." };
+    return this.proxy ? this.proxy.replay(id) : { ok: false, reason: "Session has not started yet." };
   }
   async stop() {
     if (this.stopped) return;
@@ -1452,10 +2340,10 @@ var Session = class {
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
-    const taken = existing?.some(
-      (e) => e.name === t.name && e.connected && e.deviceId === this.o.deviceId && e.lastUsedAt !== null && Date.now() - e.lastUsedAt < STALE_MS
+    const takenByLiveSession = existing?.some(
+      (e) => e.name === t.name && e.connected && e.deviceId === this.o.deviceId && e.lastUsedAt !== null && Date.now() - e.lastUsedAt < STALE_AFTER_MISSED_HEARTBEATS_MS
     );
-    if (taken) return this.fail(t, ALREADY_OPEN);
+    if (takenByLiveSession) return this.fail(t, ALREADY_OPEN);
     try {
       const res = await this.o.api.openTunnel({
         deviceId: this.o.deviceId,
@@ -1631,7 +2519,7 @@ function runPlain(session, out) {
 }
 
 // src/index.ts
-var LOGIN_HINT = "Fa\xE7a login primeiro: duto login <token> (pegue o token em https://duto.dev)";
+var LOGIN_HINT = "Log in first: duto login <token> (get your token at https://duto.dev)";
 function fail2(message2) {
   console.error(fail(message2));
   process.exit(1);
@@ -1639,19 +2527,19 @@ function fail2(message2) {
 function parsePort(raw) {
   const s = String(raw ?? "");
   const n = Number(s);
-  if (!/^\d+$/.test(s) || n < 1 || n > 65535) fail2(`Porta inv\xE1lida: ${s} (use 1\u201365535)`);
+  if (!/^\d+$/.test(s) || n < 1 || n > 65535) fail2(`Invalid port: ${s} (use 1\u201365535)`);
   return n;
 }
 function parseName(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
   const name = normalizeName(String(raw));
   const v = validateName(name);
-  if (!v.ok) fail2(v.reason === "reserved" ? `Nome reservado: "${name}". Escolha outro.` : "Nome inv\xE1lido: use s\xF3 letras min\xFAsculas e n\xFAmeros (sem h\xEDfen)");
+  if (!v.ok) fail2(v.reason === "reserved" ? `Reserved name: "${name}". Pick another.` : "Invalid name: use lowercase letters and numbers only (no hyphens)");
   return name;
 }
 function parseHostFlag(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
-  return parseHost(String(raw)) ?? fail2("Host inv\xE1lido: use s\xF3 o dom\xEDnio, como meuapp.test");
+  return parseHost(String(raw)) ?? fail2("Invalid host: use the domain only, like myapp.test");
 }
 function listFlag(raw) {
   if (raw === void 0) return [];
@@ -1661,14 +2549,14 @@ function parseAuthFlags(raw) {
   const out = [];
   for (const entry of listFlag(raw)) {
     const r = parseCredential(entry);
-    if (!r.ok) fail2(r.reason === "password" ? "Senha precisa ter de 8 a 128 caracteres" : r.reason === "user" ? "Usu\xE1rio inv\xE1lido: de 1 a 128 caracteres, sem espa\xE7o" : "Credencial inv\xE1lida: use usuario:senha");
-    if (out.some((c) => c.user === r.cred.user)) fail2(`Usu\xE1rio "${r.cred.user}" aparece duas vezes`);
+    if (!r.ok) fail2(r.reason === "password" ? "Password must be 8 to 128 characters" : r.reason === "user" ? "Invalid user: 1 to 128 characters, no spaces" : "Invalid credential: use user:password");
+    if (out.some((c) => c.user === r.cred.user)) fail2(`Duplicate user "${r.cred.user}"`);
     out.push(r.cred);
   }
   return out;
 }
 function parseAllowFlags(raw) {
-  return listFlag(raw).map((v) => parseAllowEntry(v) ? v : fail2(`"${v}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`));
+  return listFlag(raw).map((v) => parseAllowEntry(v) ? v : fail2(`"${v}" is not a known name (stripe, github) or an IP range`));
 }
 function wantsUi(flags) {
   if (flags.ui === false) return false;
@@ -1687,11 +2575,24 @@ async function runSession(specs, source, flags) {
     fail2(err instanceof Error ? err.message : String(err));
   }
   const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
-  if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-7P5GBCQX.js");
-    process.exit(await runFullscreen(session, specs, "0.6.0"));
+  let inspector = null;
+  let inspectorError;
+  if (flags.inspect !== false) {
+    try {
+      inspector = await startInspector({ session, page: inspectorPage });
+    } catch (err) {
+      inspectorError = err instanceof Error ? err.message : String(err);
+    }
   }
-  console.log(`${mark()} ${paint("muted", `${"0.6.0"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
+  if (wantsUi(flags)) {
+    const { runFullscreen } = await import("./fullscreen-IWZCH3IP.js");
+    const code = await runFullscreen(session, specs, "1.0.0", inspector, inspectorError);
+    await inspector?.close().catch(() => void 0);
+    process.exit(code);
+  }
+  console.log(`${mark()} ${paint("muted", `${"1.0.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
+  if (inspector) console.log(paint("muted", `inspector: ${inspector.openUrl}`));
+  if (inspectorError) console.log(warn(`inspector failed to start: ${inspectorError}`));
   const stopLog = runPlain(session, (l) => console.log(l));
   const stopped = new Promise((resolve) => {
     const onSignal = () => {
@@ -1708,13 +2609,14 @@ async function runSession(specs, source, flags) {
   await stopped;
   stopLog();
   await session.stop();
+  await inspector?.close().catch(() => void 0);
   process.exit(0);
 }
 async function tunnel(rawPort, flags) {
   if (rawPort === void 0) {
-    if (flags.host !== void 0) fail2("Use --host junto com a porta (duto 8080 --host meuapp.test) ou host: no duto.yml");
-    if (flags.auth !== void 0) fail2("Use --auth junto com a porta (duto 3000 --auth ana:senha) ou auth: no duto.yml");
-    if (flags.permitir !== void 0) fail2("Use --permitir junto com a porta (duto 3000 --permitir stripe) ou permitir: no duto.yml");
+    if (flags.host !== void 0) fail2("Use --host with a port (duto 8080 --host myapp.test) or host: in duto.yml");
+    if (flags.auth !== void 0) fail2("Use --auth with a port (duto 3000 --auth ana:secret) or auth: in duto.yml");
+    if (flags.allow !== void 0) fail2("Use --allow with a port (duto 3000 --allow stripe) or allow: in duto.yml");
     let found;
     try {
       found = findConfig(process.cwd());
@@ -1724,7 +2626,7 @@ async function tunnel(rawPort, flags) {
     if (!found) {
       cli.outputHelp();
       console.log(`
-${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode s\xF3 ${paint("strong", "duto")}:
+${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and just run ${paint("strong", "duto")}:
 
   tunnels:
     web: 3000
@@ -1738,30 +2640,30 @@ ${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode
   const name = parseName(flags.name) ?? null;
   const host = parseHostFlag(flags.host);
   const keepRedirects = flags.rewriteRedirects === false;
-  if (keepRedirects && !host) fail2("--no-rewrite-redirects s\xF3 vale junto com --host");
+  if (keepRedirects && !host) fail2("--no-rewrite-redirects only works with --host");
   const auth = parseAuthFlags(flags.auth);
-  const allow = parseAllowFlags(flags.permitir);
-  if (allow.length && !auth.length) fail2("--permitir s\xF3 vale junto com --auth");
-  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "linha de comando", flags);
+  const allow = parseAllowFlags(flags.allow);
+  if (allow.length && !auth.length) fail2("--allow only works with --auth");
+  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "command line", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
-cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia").action((port, opts) => tunnel(port, opts));
-cli.command("login <token>", "Salva o authtoken (pegue em https://duto.dev)").action(async (token) => {
+cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
+cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
+cli.command("login <token>", "Save your authtoken (get it at https://duto.dev)").action(async (token) => {
   try {
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
     saveConfig({ ...loadConfig(), authtoken: String(token) });
-    console.log(ok(`Conectado como ${paint("strong", me.username ?? me.email)}`));
+    console.log(ok(`Logged in as ${paint("strong", me.username ?? me.email)}`));
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
 });
-cli.command("logout", "Remove o authtoken desta m\xE1quina").action(() => {
+cli.command("logout", "Remove the authtoken from this machine").action(() => {
   const { authtoken: _removed, ...rest } = loadConfig();
   saveConfig(rest);
-  console.log(ok("Authtoken removido"));
+  console.log(ok("Authtoken removed"));
 });
-cli.command("status", "Mostra a conta e os t\xFAneis no ar").action(async () => {
+cli.command("status", "Show your account and live tunnels").action(async () => {
   const config = loadConfig();
   if (!config.authtoken) fail2(LOGIN_HINT);
   try {
@@ -1769,23 +2671,17 @@ cli.command("status", "Mostra a conta e os t\xFAneis no ar").action(async () =>
     const [me, endpoints] = await Promise.all([api.me(), api.endpoints()]);
     console.log(`${mark()}  ${paint("muted", `${me.username} \xB7 ${me.email}`)}`);
     const live = endpoints.filter((e) => e.connected);
-    if (!live.length) console.log(paint("muted", "Nenhum t\xFAnel no ar."));
+    if (!live.length) console.log(paint("muted", "No live tunnels."));
     for (const e of live)
       console.log(
-        `${paint("signal", "\u25CF")} https://${e.hostname} ${paint("muted", `\u2192 localhost:${e.port}${e.deviceId === config.deviceId ? "" : ` \xB7 ${e.deviceName ?? "outra m\xE1quina"}`}`)}`
+        `${paint("signal", "\u25CF")} https://${e.hostname} ${paint("muted", `\u2192 localhost:${e.port}${e.deviceId === config.deviceId ? "" : ` \xB7 ${e.deviceName ?? "another machine"}`}`)}`
       );
   } catch (err) {
     fail2(err instanceof DutoApiError ? err.message : String(err));
   }
 });
-cli.help(
-  (sections) => sections.map((s) => ({
-    ...s,
-    title: s.title === "Usage" ? "Uso" : s.title === "Commands" ? "Comandos" : s.title === "Options" ? "Op\xE7\xF5es" : s.title,
-    body: s.body.replace(/^\s*For more info, run any command with the `--help` flag:/m, "  Mais detalhes de um comando: duto <comando> --help").replace("Display this message", "Mostra esta ajuda").replace("Display version number", "Mostra a vers\xE3o")
-  }))
-);
-cli.version("0.6.0");
+cli.help();
+cli.version("1.0.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();