@dutodev/cli 1.4.0 → 1.6.0

package/README.md

@@ -91,7 +91,39 @@ Ways out, from simplest to most work:
 
 In every case, register `https://<name>-<user>.duto.dev/<callback path>` as the callback URL at the provider. The comparison is usually exact, with no wildcards: each person on the team has their own address.
 
-**About `X-Forwarded-*`.** `X-Forwarded-Host`, `X-Forwarded-Proto` and `X-Forwarded-For` are an old convention between reverse proxies for telling the app what the client actually asked for. The standard version is the `Forwarded` header (RFC 7239), which is less used in practice. Frameworks usually read these headers only when the proxy is marked as trusted (`trusted proxies`, `trust proxy`, `USE_X_FORWARDED_HOST`), so what `headers:` does depends on how your app is configured. On the other hand, if an app reads `X-Forwarded-Host` without that check, any client can forge it in production. Make sure the proxy in front overwrites or removes that header.
+**What you cannot set.** Some headers belong to Cloudflare, to Duto or to the HTTP connection itself. `duto.yml` refuses them, with the line and what to do:
+
+| Headers | Who sets them | In `headers:` |
+|---|---|---|
+| `CF-*` (`CF-Connecting-IP`, `CF-IPCountry`, `CF-Ray`) | Cloudflare | error |
+| `X-Forwarded-For` | Cloudflare: the client IP | error |
+| `X-Duto-*` | Duto | error; never reaches your app |
+| `Content-Length`, `Transfer-Encoding`, `Connection`, `Keep-Alive`, `Upgrade`, `Expect`, `TE`, `Trailer`, `Proxy-Connection` | Duto, per connection | error |
+| `Host` | `host:` | error, use `host:` |
+| `X-Forwarded-Host`, `-Proto`, `-Port`, `-Prefix` | you | replaces the value; `""` removes it |
+| everything else | you | replaces the value; `""` removes it |
+
+Values must be ASCII or Latin-1 text. `${VAR}` reads from an environment variable, so tokens stay out of git:
+
+```yaml
+headers:
+  Authorization: Bearer ${API_TOKEN}
+```
+
+If a tunnel without `auth:` injects a credential (`Authorization`, `Cookie`, `X-Api-Key`, `*-Token`…), the CLI warns at start: anyone with the URL is signed in as that credential.
+
+**Forged `X-Forwarded-*`.** Cloudflare sets `X-Forwarded-Proto` and `X-Forwarded-For`, but nobody sets `X-Forwarded-Host`, `X-Forwarded-Port` or `X-Forwarded-Prefix`: any value that arrives was written by the client. Duto removes those three by default, so an app that trusts them cannot be fooled. When a reverse proxy you trust sits in front of the tunnel (a Vercel rewrite, a staging nginx, a company gateway), or when you test with `curl -H 'X-Forwarded-Host: acme.test'`, let them through:
+
+```yaml
+tunnels:
+  shop:
+    port: 8080
+    trust_forwarded: true
+```
+
+Values in `headers:` always win. With `host:`, `X-Forwarded-Host` is still not sent.
+
+**About `X-Forwarded-*`.** These headers are an old convention between reverse proxies for telling the app what the client actually asked for. The standard version is the `Forwarded` header (RFC 7239), which is less used in practice. Frameworks usually read them only when the proxy is marked as trusted (`trusted proxies`, `trust proxy`, `USE_X_FORWARDED_HOST`), so what `headers:` does depends on how your app is configured.
 
 ## Password-protect a tunnel
 
@@ -162,6 +194,12 @@ Outside an interactive terminal (pipe, CI) or with `--no-ui`, the CLI prints a p
 
 With every session, the CLI starts a local inspector: a browser page with requests arriving live, formatted JSON, and buttons to copy and replay. It is more comfortable than the terminal for large bodies.
 
+- **Overview.** Each request shows who answered (your app or duto), total time and time to first byte, the data center, the client, the query, the cookies sent and set, and the redirect target.
+- **Issues.** The inspector flags what usually breaks a tunnel: nothing listening on the port, a redirect to `localhost` or down to `http`, a cookie the browser drops (`Domain` mismatch, `SameSite=None` without `Secure`), a CORS response or preflight the browser blocks, and response bodies that link to `localhost`. Each one says what to change.
+- **Flows.** A redirect is linked to the request the same browser made next, so a login or OAuth round trip reads as one chain you can step through.
+- **Filters.** Type terms like `status:4xx`, `status:>=500`, `method:post`, `path:/api`, `is:redirect`, `is:issue`, `is:duto` or `duration:>500ms`. Start a term with `-` to exclude it. The buttons under the filter (Errors, Redirects, Issues, Slow) apply the common ones.
+- **Changed by Duto.** Each request lists what Duto changed before your app got it, and why: headers from `headers:`, the Host from `host:`, forged `X-Forwarded-*` from the client, Duto's own credentials, the rewritten `Location` and how the tunnel password let it in. The headers shown are the ones your app received.
+- **Clear and export.** Clear hides what is already listed, so you can reproduce a flow from a clean list. Export HAR saves the listed requests for Chrome DevTools or any HAR viewer. Values that came from `headers:` are masked in the HAR (`••• (duto.yml)`), so you can share it.
 - **How to open it.** In the full screen, key `i` opens the browser at the right address, and the screen shows `inspector  http://127.0.0.1:<port>`. In plain mode (pipe, CI, `--no-ui`), the CLI prints `inspector: <url>?t=<token>`; copy that whole address.
 - **Port.** The default is `127.0.0.1:4141`. If it is taken, the CLI tries the next ones up to 4161 and then any free port. The inspector listens on `127.0.0.1` only: other machines on your network cannot reach it.
 - **Token.** The address carries a session token (`?t=...`). It exists so other sites open in your browser cannot read or replay your requests. That is why the full screen does not show the token; use key `i`.

package/dist/{chunk-4SIBC52A.js → chunk-DUC4RSBW.js}

@@ -408,6 +408,41 @@ function compareVersions(a, b) {
   return 0;
 }
 
+// ../shared/src/headers.ts
+var FRAMING_HEADERS = ["content-length", "transfer-encoding", "connection", "keep-alive", "upgrade", "expect", "te", "trailer", "proxy-connection"];
+var FORWARDED_ADDRESS_HEADERS = ["x-forwarded-host", "x-forwarded-proto", "x-forwarded-port", "x-forwarded-prefix"];
+var UNTRUSTED_VISITOR_HEADERS = ["x-forwarded-host", "x-forwarded-port", "x-forwarded-prefix"];
+var CREDENTIAL_NAMES = ["authorization", "cookie", "proxy-authorization", "x-forwarded-user", "remote-user", "x-remote-user"];
+var CREDENTIAL_SUFFIXES = ["-token", "-api-key", "-apikey", "-secret"];
+var VALID_VALUE = /^[\t\x20-\x7e\x80-\xff]*$/;
+function headerGroup(name) {
+  const n = name.toLowerCase();
+  if (n.startsWith("cf-")) return "cloudflare";
+  if (n.startsWith("x-duto-")) return "duto";
+  if (FRAMING_HEADERS.includes(n)) return "framing";
+  if (n === "host") return "host";
+  if (n === "x-forwarded-for") return "client-ip";
+  if (FORWARDED_ADDRESS_HEADERS.includes(n)) return "forwarded-address";
+  return "other";
+}
+var RESERVED_REASONS = {
+  cloudflare: "is set by Cloudflare",
+  duto: "is reserved for Duto",
+  framing: "is set by Duto",
+  "client-ip": "carries the client IP and is set by Cloudflare"
+};
+function reservedHeaderError(name) {
+  const reason = RESERVED_REASONS[headerGroup(name)];
+  return reason ? `${name} ${reason}. Remove it from headers.` : null;
+}
+function isValidHeaderValue(value) {
+  return VALID_VALUE.test(value);
+}
+function isCredentialLike(name) {
+  const n = name.toLowerCase();
+  return CREDENTIAL_NAMES.includes(n) || CREDENTIAL_SUFFIXES.some((s) => n.endsWith(s));
+}
+
 // src/config.ts
 import { randomUUID } from "crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -489,6 +524,26 @@ function updateLine(latest) {
   return `duto ${latest} is available. Update: ${CLI_UPDATE_COMMAND}`;
 }
 
+// src/inspector/changes.ts
+var SIGNS = { add: "+", replace: "~", remove: "\u2212" };
+function headerLabel(name) {
+  return name.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("-");
+}
+function reasonOf(c) {
+  if (c.source === "headers") return c.kind === "remove" ? 'headers: ""' : "headers:";
+  if (c.source === "host") return "host:";
+  if (c.source === "visitor") return "from the visitor; set trust_forwarded: true to keep it";
+  return "Duto credential";
+}
+function valueOf(c) {
+  if (c.kind === "replace") return `${c.from ?? ""} \u2192 ${c.to ?? ""}`;
+  return (c.kind === "add" ? c.to : c.from) ?? "";
+}
+function describeChange(c) {
+  const sign = c.kind === "replace" && c.source === "host" ? " " : SIGNS[c.kind];
+  return { label: `${sign} ${headerLabel(c.name)}`, value: valueOf(c), reason: reasonOf(c) };
+}
+
 // src/ui/theme.ts
 var C = {
   signal: "#2dd4bf",
@@ -552,10 +607,17 @@ export {
   placeOf,
   CLI_VERSION_HEADER,
   CLI_USER_AGENT,
+  FRAMING_HEADERS,
+  UNTRUSTED_VISITOR_HEADERS,
+  reservedHeaderError,
+  isValidHeaderValue,
+  isCredentialLike,
   dutoHome,
   apiUrl,
   saveConfig,
   loadConfig,
+  headerLabel,
+  describeChange,
   C,
   tunnelColor,
   fit,

package/dist/{fullscreen-MZMQ6ADN.js → fullscreen-MSVJF43W.js}

@@ -4,6 +4,7 @@ import {
   MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
+  describeChange,
   fit,
   formatBytes,
   formatDuration,
@@ -14,7 +15,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-4SIBC52A.js";
+} from "./chunk-DUC4RSBW.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -87,6 +88,18 @@ function Detail({ record }) {
         record.redirect.to
       ] })
     ] }),
+    record.headerChanges && record.headerChanges.length > 0 && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginTop: 1, children: [
+      /* @__PURE__ */ jsx(Text, { color: C.signal, children: "Changed by Duto" }),
+      record.headerChanges.map(describeChange).map((c, i) => /* @__PURE__ */ jsxs(Text, { wrap: "truncate-end", children: [
+        c.label,
+        " ",
+        c.value,
+        /* @__PURE__ */ jsxs(Text, { color: C.muted, children: [
+          "  ",
+          c.reason
+        ] })
+      ] }, i))
+    ] }),
     /* @__PURE__ */ jsx(Section, { title: "Request", headers: record.reqHeaders, body: record.reqBody, truncated: record.reqTruncated, note: bodyNote(record, "req") }),
     /* @__PURE__ */ jsx(Section, { title: "Response", headers: record.resHeaders, body: record.resBody, truncated: record.resTruncated, note: bodyNote(record, "res") }),
     /* @__PURE__ */ jsxs(Text, { color: C.muted, children: [
@@ -299,7 +312,11 @@ var KEYS = [
   ["tab", "focus"],
   ["q", "quit"]
 ];
-function App({ session, version, system, onExit, inspector = null, inspectorError, update = null }) {
+function startupMessage(inspectorError, warnings) {
+  const lines = [...inspectorError ? [`Inspector failed to start: ${inspectorError}`] : [], ...warnings];
+  return lines.length ? { text: lines.join("  "), tone: "warn" } : null;
+}
+function App({ session, version, system, onExit, inspector = null, inspectorError, warnings = [], update = null }) {
   const subState = useCallback((fn) => session.subscribe(fn), [session]);
   const subRecords = useCallback((fn) => session.records.subscribe(fn), [session]);
   const state = useSyncExternalStore(subState, () => session.getState());
@@ -312,7 +329,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
   const [focus, setFocus] = useState("requests");
   const [selReq, setSelReq] = useState(0);
   const [selTun, setSelTun] = useState(0);
-  const [message, setMessage] = useState(inspectorError ? { text: `Inspector failed to start: ${inspectorError}`, tone: "warn" } : null);
+  const [message, setMessage] = useState(() => startupMessage(inspectorError, warnings));
   const [now, setNow] = useState(() => Date.now());
   const quitting = useRef(false);
   const records = useMemo(() => {
@@ -564,7 +581,7 @@ var realSystem = {
 
 // src/ui/fullscreen.tsx
 import { jsx as jsx7 } from "react/jsx-runtime";
-function runFullscreen(session, specs, version, inspector, inspectorError, update = Promise.resolve(null)) {
+function runFullscreen(session, specs, version, inspector, inspectorError, update = Promise.resolve(null), warnings = []) {
   return withFullscreen(
     process.stdout,
     (signal) => new Promise((resolve) => {
@@ -575,7 +592,7 @@ function runFullscreen(session, specs, version, inspector, inspectorError, updat
         app.unmount();
         resolve(code);
       };
-      const view = (latest) => /* @__PURE__ */ jsx7(App, { session, version, system: realSystem, inspector, inspectorError, update: latest, onExit: () => finish(0) });
+      const view = (latest) => /* @__PURE__ */ jsx7(App, { session, version, system: realSystem, inspector, inspectorError, warnings, update: latest, onExit: () => finish(0) });
       const app = render(view(null), { exitOnCtrlC: false });
       void update.then((latest) => {
         if (latest && !done) app.rerender(view(latest));