@dutodev/cli 1.4.0 → 1.6.0

package/dist/index.js

@@ -3,24 +3,31 @@ import {
   C,
   CLI_USER_AGENT,
   CLI_VERSION_HEADER,
+  FRAMING_HEADERS,
   MAX_NAME,
   TRUNCATED_NOTE,
+  UNTRUSTED_VISITOR_HEADERS,
   apiUrl,
   bodyNote,
   checkForUpdate,
+  describeChange,
   dutoHome,
   formatBytes,
   formatDuration,
   formatTime,
+  headerLabel,
+  isCredentialLike,
+  isValidHeaderValue,
   loadConfig,
   localLabel,
   normalizeName,
   placeOf,
+  reservedHeaderError,
   saveConfig,
   statusColor,
   updateLine,
   validateName
-} from "./chunk-4SIBC52A.js";
+} from "./chunk-DUC4RSBW.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -36,8 +43,8 @@ var SGR = {
   warn: "38;2;250;204;21",
   err: "38;2;248;113;113"
 };
-function paint(tone, text, stream) {
-  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text}\x1B[0m` : text;
+function paint(tone, text2, stream) {
+  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text2}\x1B[0m` : text2;
 }
 var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
 var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
@@ -50,7 +57,7 @@ import { join as join5, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.4.0";
+var CLI_VERSION = "1.6.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -368,7 +375,7 @@ var CONFIG_FILES = ["duto.yml", "duto.yaml"];
 var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "allow"];
+var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "trust_forwarded", "auth", "allow"];
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -383,14 +390,29 @@ function parseCredential(raw) {
   if (password.length < 8 || password.length > 128) return { ok: false, reason: "password" };
   return { ok: true, cred: { user, password } };
 }
+function expandEnv(text2, env, missing) {
+  return text2.replace(ENV_REF_RE, (_m, name) => {
+    const val = env[name];
+    if (val === void 0) throw missing(name);
+    return val;
+  });
+}
+function headerText(node) {
+  if (node === null) return "";
+  if (!isScalar(node)) return void 0;
+  if (node.value === null) return "";
+  if (typeof node.value === "string") return node.value;
+  if (typeof node.value === "number" || typeof node.value === "boolean") return node.source ?? String(node.value);
+  return void 0;
+}
 function portOf(value) {
   const v = isMap(value) ? value.get("port") : isScalar(value) ? value.value : value;
   return typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= 65535 ? v : null;
 }
-function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
+function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
   const fail3 = (message2, line) => new ConfigError(message2, line, file);
   const lc = new LineCounter();
-  const doc = parseDocument(text, { lineCounter: lc, prettyErrors: false });
+  const doc = parseDocument(text2, { lineCounter: lc, prettyErrors: false });
   const lineAt = (offset) => offset === void 0 ? void 0 : lc.linePos(offset).line;
   if (doc.errors.length) {
     const e = doc.errors[0];
@@ -401,9 +423,9 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
     throw fail3('declare the tunnels under "tunnels:", one per line (e.g. web: 3000)');
   }
   const specs = [];
-  for (const pair of tunnels.items) {
-    const raw = isScalar(pair.key) ? String(pair.key.value) : "";
-    const line = lineAt(pair.key?.range?.[0]);
+  for (const pair2 of tunnels.items) {
+    const raw = isScalar(pair2.key) ? String(pair2.key.value) : "";
+    const line = lineAt(pair2.key?.range?.[0]);
     const name = normalizeName(raw);
     const v = validateName(name);
     if (!v.ok) {
@@ -412,14 +434,14 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
         line
       );
     }
-    const port = portOf(pair.value);
+    const port = portOf(pair2.value);
     if (port === null) throw fail3(`invalid port for "${raw}" (use 1\u201365535)`, line);
     const spec = { name, port };
-    if (isMap(pair.value)) {
-      const body = pair.value;
+    if (isMap(pair2.value)) {
+      const body = pair2.value;
       for (const item of body.items) {
         const key = isScalar(item.key) ? String(item.key.value) : "";
-        if (!TUNNEL_KEYS.includes(key)) throw fail3(`unknown key in "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth or allow)`, line);
+        if (!TUNNEL_KEYS.includes(key)) throw fail3(`unknown key in "${raw}": ${key} (use port, host, headers, rewrite_redirects, trust_forwarded, auth or allow)`, line);
       }
       const hostNode = body.get("host", true);
       if (hostNode !== void 0) {
@@ -430,21 +452,22 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
       const headersNode = body.get("headers", true);
       if (headersNode !== void 0) {
         if (!isMap(headersNode)) throw fail3(`headers in "${raw}" must be a list of Name: value`, line);
-        const headers = {};
+        const headers = /* @__PURE__ */ new Map();
         for (const h of headersNode.items) {
           const hName = isScalar(h.key) ? String(h.key.value) : "";
           const hLine = lineAt(h.key?.range?.[0]);
-          if (!HEADER_NAME_RE.test(hName)) throw fail3(`invalid header in "${raw}": "${hName}"`, hLine);
+          if (!HEADER_NAME_RE.test(hName) || hName === "__proto__") throw fail3(`invalid header in "${raw}": "${hName}"`, hLine);
           if (hName.toLowerCase() === "host") throw fail3(`to change the Host of "${raw}", use host: instead of headers`, hLine);
-          const value = h.value === null ? null : isScalar(h.value) ? h.value.value : void 0;
-          if (value !== null && !["string", "number", "boolean"].includes(typeof value)) {
-            throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
-          }
-          const str = value === null ? "" : String(value);
-          if (/[\r\n]/.test(str)) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
-          headers[hName.toLowerCase()] = str;
+          const reserved = reservedHeaderError(hName);
+          if (reserved) throw fail3(reserved, hLine);
+          if (headers.has(hName.toLowerCase())) throw fail3(`header ${hName} appears twice in "${raw}"`, hLine);
+          const text3 = headerText(h.value);
+          if (text3 === void 0) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
+          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}")`, hLine));
+          if (!isValidHeaderValue(value)) throw fail3(`invalid character in the value of ${hName} in "${raw}". Use ASCII or Latin-1 text.`, hLine);
+          headers.set(hName.toLowerCase(), value);
         }
-        spec.headers = headers;
+        spec.headers = Object.fromEntries(headers);
       }
       const rewriteNode = body.get("rewrite_redirects", true);
       if (rewriteNode !== void 0) {
@@ -453,19 +476,21 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
         if (!spec.host) throw fail3(`rewrite_redirects in "${raw}" only works together with host:`, line);
         if (value === false) spec.rewriteRedirects = false;
       }
+      const trustNode = body.get("trust_forwarded", true);
+      if (trustNode !== void 0) {
+        const value = isScalar(trustNode) ? trustNode.value : void 0;
+        if (typeof value !== "boolean") throw fail3(`trust_forwarded in "${raw}" must be true or false`, line);
+        if (value) spec.trustForwarded = true;
+      }
       const authNode = body.get("auth", true);
       if (authNode !== void 0) {
         if (!isSeq(authNode)) throw fail3(`auth in "${raw}" must be a list of user:password`, line);
         const auth = [];
         for (const item of authNode.items) {
           const iLine = lineAt(item.range?.[0]) ?? line;
-          const text2 = isScalar(item) && typeof item.value === "string" ? item.value : null;
-          if (text2 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
-          const expanded = text2.replace(ENV_REF_RE, (_m, name2) => {
-            const val = env[name2];
-            if (val === void 0) throw fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine);
-            return val;
-          });
+          const text3 = isScalar(item) && typeof item.value === "string" ? item.value : null;
+          if (text3 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
+          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine));
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
             if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
@@ -513,6 +538,19 @@ function findConfig(cwd) {
   }
 }
 
+// src/session/warnings.ts
+function joinNames(names) {
+  return names.length < 2 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
+}
+function credentialWarnings(specs) {
+  return specs.flatMap((spec) => {
+    if (spec.auth?.length) return [];
+    const names = Object.entries(spec.headers ?? {}).filter(([name, value]) => value !== "" && isCredentialLike(name)).map(([name]) => headerLabel(name));
+    if (!names.length) return [];
+    return [`${spec.name ?? `localhost:${spec.port}`} injects ${joinNames(names)} and has no auth: anyone with the URL is signed in.`];
+  });
+}
+
 // src/login.ts
 import { spawn } from "child_process";
 import { hostname } from "os";
@@ -523,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.4.0",
+    cliVersion: "1.6.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -615,13 +653,78 @@ function edgeLabel(edge) {
   return place ? "via " + edge.colo + " (" + place + ")" : "via " + edge.colo;
 }
 
+// src/inspector/filter.ts
+function matchesFilter(item, text2) {
+  function compare(value, spec, unit) {
+    const m = /^(>=|<=|>|<|=)?(.+)$/.exec(spec);
+    if (!m) return null;
+    const limit = unit(m[2] ?? "");
+    if (limit === null) return null;
+    if (value === null) return false;
+    const op = m[1] || "=";
+    if (op === ">") return value > limit;
+    if (op === ">=") return value >= limit;
+    if (op === "<") return value < limit;
+    if (op === "<=") return value <= limit;
+    return value === limit;
+  }
+  function plainNumber(raw) {
+    return /^\d+$/.test(raw) ? Number(raw) : null;
+  }
+  function millis(raw) {
+    const m = /^(\d+(?:\.\d+)?)(ms|s)?$/.exec(raw);
+    if (!m) return null;
+    return m[2] === "s" ? Number(m[1]) * 1e3 : Number(m[1]);
+  }
+  function status(spec) {
+    const cls = /^([1-5])xx$/.exec(spec);
+    if (cls) return item.status !== null && Math.floor(item.status / 100) === Number(cls[1]);
+    return compare(item.status, spec, plainNumber);
+  }
+  function kind(spec) {
+    const s = item.status;
+    if (spec === "error") return s !== null && s >= 400 || !!item.error;
+    if (spec === "redirect") return s !== null && s >= 300 && s < 400;
+    if (spec === "rewritten") return !!item.rewritten;
+    if (spec === "replay") return item.replayOf !== void 0;
+    if (spec === "ws") return item.websocket;
+    if (spec === "pending") return s === null && !item.error;
+    if (spec === "issue") return (item.issues ?? 0) > 0;
+    if (spec === "duto") return item.origin === "duto";
+    if (spec === "app") return item.origin === "app";
+    return null;
+  }
+  function field(key, value) {
+    const v = value.toLowerCase();
+    if (key === "status") return status(v);
+    if (key === "is") return kind(v);
+    if (key === "duration") return compare(item.durationMs, v, millis);
+    if (key === "method") return (item.websocket ? "ws" : item.method.toLowerCase()) === v;
+    if (key === "tunnel") return item.tunnel.toLowerCase() === v;
+    if (key === "path") return item.path.toLowerCase().indexOf(v) >= 0;
+    if (key === "client") return (item.client ?? "").toLowerCase() === v;
+    return null;
+  }
+  const haystack = [item.tunnel, item.websocket ? "ws" : item.method, item.path, item.status === null ? "" : String(item.status), item.client ?? ""].join(" ").toLowerCase();
+  const terms = text2.trim().split(/\s+/).filter(Boolean);
+  for (const raw of terms) {
+    const negate = raw.length > 1 && raw.charAt(0) === "-";
+    const term = negate ? raw.slice(1) : raw;
+    const sep = term.indexOf(":");
+    let hit = sep > 0 ? field(term.slice(0, sep).toLowerCase(), term.slice(sep + 1)) : null;
+    if (hit === null) hit = haystack.indexOf(term.toLowerCase()) >= 0;
+    if (hit === negate) return false;
+  }
+  return true;
+}
+
 // src/inspector/jsonView.ts
 function countLabel(n, one, many) {
   return n + " " + (n === 1 ? one : many);
 }
-function jsonSyntaxError(text) {
+function jsonSyntaxError(text2) {
   try {
-    JSON.parse(text);
+    JSON.parse(text2);
     return null;
   } catch (e) {
     const message2 = String(e && e.message ? e.message : e);
@@ -631,65 +734,65 @@ function jsonSyntaxError(text) {
     if (lc) {
       let idx = 0;
       for (let ln = 1; ln < Number(lc[1]); ln++) {
-        const nl = text.indexOf("\n", idx);
-        if (nl < 0) return { position: text.length, message: message2 };
+        const nl = text2.indexOf("\n", idx);
+        if (nl < 0) return { position: text2.length, message: message2 };
         idx = nl + 1;
       }
-      return { position: Math.min(idx + Number(lc[2]) - 1, text.length), message: message2 };
+      return { position: Math.min(idx + Number(lc[2]) - 1, text2.length), message: message2 };
     }
-    return { position: text.length, message: message2 };
+    return { position: text2.length, message: message2 };
   }
 }
-function jsonTokens(text) {
+function jsonTokens(text2) {
   const out = [];
   let depth = 0;
   let i = 0;
-  while (i < text.length) {
-    const c = text.charAt(i);
+  while (i < text2.length) {
+    const c = text2.charAt(i);
     let j = i + 1;
     let kind;
     if (c === " " || c === "\n" || c === "	" || c === "\r") {
-      while (j < text.length && " \n	\r".indexOf(text.charAt(j)) >= 0) j++;
+      while (j < text2.length && " \n	\r".indexOf(text2.charAt(j)) >= 0) j++;
       kind = "space";
     } else if (c === '"') {
-      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
-      j = Math.min(j + 1, text.length);
+      while (j < text2.length && text2.charAt(j) !== '"') j += text2.charAt(j) === "\\" ? 2 : 1;
+      j = Math.min(j + 1, text2.length);
       let k = j;
-      while (k < text.length && " \n	\r".indexOf(text.charAt(k)) >= 0) k++;
-      kind = text.charAt(k) === ":" ? "key" : "string";
+      while (k < text2.length && " \n	\r".indexOf(text2.charAt(k)) >= 0) k++;
+      kind = text2.charAt(k) === ":" ? "key" : "string";
     } else if ("{}[],:".indexOf(c) >= 0) {
       kind = "punct";
       if (c === "}" || c === "]") depth = Math.max(0, depth - 1);
     } else {
-      while (j < text.length && ' \n	\r{}[],:"'.indexOf(text.charAt(j)) < 0) j++;
-      const word = text.slice(i, j);
+      while (j < text2.length && ' \n	\r{}[],:"'.indexOf(text2.charAt(j)) < 0) j++;
+      const word = text2.slice(i, j);
       kind = word === "true" || word === "false" || word === "null" ? "literal" : "number";
     }
-    out.push({ kind, text: text.slice(i, j), depth });
+    out.push({ kind, text: text2.slice(i, j), depth });
     if (kind === "punct" && (c === "{" || c === "[")) depth++;
     i = j;
   }
   return out;
 }
-function jsonIndent(text) {
+function jsonIndent(text2) {
   let out = "";
   let depth = 0;
   let i = 0;
   const ws = " \n	\r";
-  while (i < text.length) {
-    const c = text.charAt(i);
+  while (i < text2.length) {
+    const c = text2.charAt(i);
     if (ws.indexOf(c) >= 0) {
       i++;
     } else if (c === '"') {
       let j = i + 1;
-      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
-      out += text.slice(i, j + 1);
+      while (j < text2.length && text2.charAt(j) !== '"') j += text2.charAt(j) === "\\" ? 2 : 1;
+      out += text2.slice(i, j + 1);
       i = j + 1;
     } else if (c === "{" || c === "[") {
       let j = i + 1;
-      while (j < text.length && ws.indexOf(text.charAt(j)) >= 0) j++;
-      if (text.charAt(j) === (c === "{" ? "}" : "]")) {
-        out += c + text.charAt(j);
+      while (j < text2.length && ws.indexOf(text2.charAt(j)) >= 0) j++;
+      if (text2.charAt(j) === (c === "{" ? "}" : "]")) {
+        out += c + text2.charAt(j);
         i = j + 1;
       } else {
         depth++;
@@ -708,8 +811,8 @@ function jsonIndent(text) {
       i++;
     } else {
       let j = i + 1;
-      while (j < text.length && (ws + '{}[],:"').indexOf(text.charAt(j)) < 0) j++;
-      out += text.slice(i, j);
+      while (j < text2.length && (ws + '{}[],:"').indexOf(text2.charAt(j)) < 0) j++;
+      out += text2.slice(i, j);
       i = j;
     }
   }
@@ -741,14 +844,14 @@ button { font: inherit; color: inherit; background: none; border: 0; padding: 0;
 .tunnels { display: flex; flex-wrap: wrap; gap: 4px 14px; justify-content: flex-end; min-width: 0; }
 .tunnels .k { color: ${C.strong}; }
 .banner { padding: 6px 12px; background: ${BAR}; border-bottom: 1px solid ${C.err}; color: ${C.err}; }
-.main { flex: 1; min-height: 0; display: grid; grid-template-columns: 320px 1fr; }
+.main { flex: 1; min-height: 0; display: grid; grid-template-columns: 400px 1fr; }
 .side { display: flex; flex-direction: column; min-height: 0; border-right: 1px solid ${LINE}; }
 .search { margin: 8px 12px; padding: 5px 8px; border: 1px solid ${INPUT_LINE}; border-radius: 5px; background: ${BG}; color: ${TEXT}; font: inherit; outline: none; }
 .search:focus { border-color: ${C.signal}; }
 .search::placeholder { color: ${C.muted}; }
 .list { flex: 1; min-height: 0; overflow-y: auto; outline: none; }
-.row { display: grid; grid-template-columns: 14px 42px minmax(0, 1fr) 34px 56px; gap: 8px; padding: 5px 12px; border-bottom: 1px solid ${ROW_LINE}; align-items: center; cursor: pointer; white-space: nowrap; }
-.list.multi .row { grid-template-columns: 14px 56px 42px minmax(0, 1fr) 34px 56px; }
+.row { display: grid; grid-template-columns: 14px 56px minmax(0, 1fr) 34px 60px; gap: 8px; padding: 5px 12px; border-bottom: 1px solid ${ROW_LINE}; align-items: center; cursor: pointer; white-space: nowrap; }
+.list.multi .row { grid-template-columns: 14px 56px 56px minmax(0, 1fr) 34px 60px; }
 .row:hover { background: #141917; }
 .row.sel { background: ${SELECTED}; box-shadow: inset 2px 0 0 ${C.signal}; }
 .row span { overflow: hidden; text-overflow: ellipsis; }
@@ -756,7 +859,30 @@ button { font: inherit; color: inherit; background: none; border: 0; padding: 0;
 .m { font-weight: 700; }
 .mut { color: ${C.muted}; }
 .sig { color: ${C.signal}; }
-.redirect { margin-top: 6px; display: grid; gap: 2px; }
+.warn { color: ${C.warn}; }
+.errc { color: ${C.err}; }
+.row.inflow { box-shadow: inset 2px 0 0 ${C.muted}; }
+.row.sel.inflow { box-shadow: inset 2px 0 0 ${C.signal}; }
+.to { color: ${C.muted}; }
+.chips { display: flex; flex-wrap: wrap; gap: 6px; padding: 0 12px 8px; }
+.chip { border: 1px solid ${INPUT_LINE}; border-radius: 999px; padding: 1px 8px; color: ${C.muted}; }
+.chip:hover { color: ${TEXT}; }
+.chip.on { border-color: ${C.signal}; color: ${C.signal}; }
+.chip b { font-weight: 400; color: ${TEXT}; }
+.sidebar-foot { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; padding: 8px 12px; border-top: 1px solid ${LINE}; }
+.help { padding: 0 12px 8px; color: ${C.muted}; display: grid; gap: 2px; }
+.help code { color: ${TEXT}; font: inherit; }
+.ov { padding: 4px 0 12px; }
+.issue { margin: 8px 12px 0; padding: 6px 10px; border-left: 2px solid ${C.warn}; background: #16140f; }
+.issue.error { border-left-color: ${C.err}; background: #1a1112; }
+.issue.info { border-left-color: ${C.muted}; background: #141716; }
+.issue b { display: block; color: ${C.strong}; font-weight: 600; }
+.issue span { color: ${C.muted}; }
+.flow { margin: 6px 12px 0; display: grid; gap: 2px; max-width: 760px; }
+.step { display: grid; grid-template-columns: 40px 52px minmax(0, 1fr) 40px; gap: 8px; text-align: left; padding: 2px 6px; border-radius: 4px; }
+.step:hover { background: #141917; }
+.step.cur { background: ${SELECTED}; box-shadow: inset 2px 0 0 ${C.signal}; }
+.step span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .empty { padding: 12px; color: ${C.muted}; }
 .detail { display: flex; flex-direction: column; min-height: 0; min-width: 0; }
 .pane { flex: 1; }
@@ -798,14 +924,20 @@ th { color: ${JSON_KEY}; font-weight: 400; white-space: nowrap; }
 var SCRIPT = String.raw`"use strict";
 var countLabel = (${countLabel.toString()});
 var edgeLabel = (${edgeLabel.toString()});
+var matchesFilter = (${matchesFilter.toString()});
 var jsonSyntaxError = (${jsonSyntaxError.toString()});
 var jsonTokens = (${jsonTokens.toString()});
 var jsonIndent = (${jsonIndent.toString()});
 var COLORS = ${JSON.stringify(C)};
 var TOKEN = new URLSearchParams(location.search).get("t") || "";
-var TABS = ["Body", "Headers", "Response", "Raw"];
+var CHIPS = [
+  { label: "Errors", query: "is:error" },
+  { label: "Redirects", query: "is:redirect" },
+  { label: "Issues", query: "is:issue" },
+  { label: "Slow", query: "duration:>1s" }
+];
 
-var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Body", ended: false };
+var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Overview", ended: false, clearedAfter: 0 };
 var listSeq = 0, detailSeq = 0, msgTimer = null;
 var es = null, lost = false, replaying = false;
 function fail(e) { if (!state.ended) console.error(e); }
@@ -857,14 +989,60 @@ function header(h, name) {
   for (var k in h) if (k.toLowerCase() === name) return h[k];
   return "";
 }
+function kept() {
+  return state.items.filter(function (it) { return it.id > state.clearedAfter; });
+}
 function visible() {
-  var f = $("filter").value.trim().toLowerCase();
-  if (!f) return state.items;
-  return state.items.filter(function (it) {
-    return (it.tunnel + " " + (it.websocket ? "ws" : it.method) + " " + it.path + " " + (it.status === null || it.status === undefined ? "" : it.status)).toLowerCase().indexOf(f) >= 0;
+  var f = $("filter").value;
+  return kept().filter(function (it) { return matchesFilter(it, f); });
+}
+function setFilter(text) {
+  $("filter").value = text;
+  renderList();
+}
+
+function renderChips() {
+  var box = $("chips");
+  clear(box);
+  var current = $("filter").value.trim();
+  var items = kept();
+  CHIPS.forEach(function (c) {
+    var n = items.filter(function (it) { return matchesFilter(it, c.query); }).length;
+    var b = el("button", "chip" + (current === c.query ? " on" : ""));
+    b.type = "button";
+    b.title = c.query;
+    b.appendChild(document.createTextNode(c.label + " "));
+    b.appendChild(el("b", "", n));
+    b.addEventListener("click", function () { setFilter(current === c.query ? "" : c.query); });
+    box.appendChild(b);
   });
 }
 
+function itemById(id) {
+  for (var i = 0; i < state.items.length; i++) if (state.items[i].id === id) return state.items[i];
+  return null;
+}
+function chainOf(id) {
+  var ids = {};
+  var start = itemById(id);
+  if (!start || (start.prev === undefined && start.next === undefined)) return ids;
+  var cur = start, guard = 0;
+  while (cur && cur.prev !== undefined && guard++ < 50) cur = itemById(cur.prev);
+  guard = 0;
+  while (cur && guard++ < 50) {
+    ids[cur.id] = true;
+    cur = cur.next === undefined ? null : itemById(cur.next);
+  }
+  return ids;
+}
+
+function markOf(it) {
+  if (it.issues > 0) return { text: "!", cls: it.origin === "duto" || it.error ? "errc" : "warn", title: it.issues === 1 ? "1 issue" : it.issues + " issues" };
+  if (it.replayOf !== undefined) return { text: "↻", cls: "mut", title: "replay of #" + it.replayOf };
+  if (it.rewritten) return { text: "↪", cls: "sig", title: "Location rewritten" };
+  return { text: "", cls: "mut", title: "" };
+}
+
 function renderTop() {
   var n = state.items.length;
   $("count").textContent = countLabel(n, "request", "requests");
@@ -883,26 +1061,29 @@ function renderList() {
   var multi = state.tunnels.length > 1;
   list.classList.toggle("multi", multi);
   clear(list);
+  renderChips();
+  $("clear").textContent = state.clearedAfter > 0 ? "Show all" : "Clear";
   var items = visible();
   if (items.length === 0) {
-    list.appendChild(el("div", "empty", state.items.length === 0 ? "No requests yet." : "No requests match the filter."));
+    var none = state.items.length === 0 ? "No requests yet." : kept().length === 0 ? "Cleared. New requests show up here." : "No requests match the filter.";
+    list.appendChild(el("div", "empty", none));
     return;
   }
+  var flow = state.selected === null ? {} : chainOf(state.selected);
   items.forEach(function (it) {
-    var row = el("div", "row" + (it.id === state.selected ? " sel" : ""));
+    var row = el("div", "row" + (it.id === state.selected ? " sel" : "") + (flow[it.id] ? " inflow" : ""));
     row.setAttribute("role", "option");
     row.setAttribute("aria-selected", it.id === state.selected ? "true" : "false");
     row.dataset.id = String(it.id);
-    if (it.replayOf !== undefined) row.appendChild(el("span", "mut", "↻"));
-    else if (it.rewritten) {
-      var mark = el("span", "sig", "↪");
-      mark.title = "Location rewritten";
-      row.appendChild(mark);
-    } else row.appendChild(el("span", "mut", ""));
+    var mark = markOf(it);
+    var ms = el("span", mark.cls, mark.text);
+    ms.title = mark.title;
+    row.appendChild(ms);
     if (multi) row.appendChild(el("span", "mut", it.tunnel));
     row.appendChild(el("span", "m", methodOf(it)));
     var p = el("span", "", it.path);
-    p.title = it.path;
+    p.title = it.location ? it.path + " → " + it.location : it.path;
+    if (it.location) p.appendChild(el("span", "to", " → " + it.location));
     row.appendChild(p);
     var st = statusInfo(it);
     var s = el("span", "", st.text);
@@ -980,13 +1161,6 @@ function renderDetail() {
   if (d.replayOf !== undefined) parts.push("↻ replay of #" + d.replayOf);
   head.appendChild(el("span", "mut", " · " + parts.join(" · ")));
   if (d.error) head.appendChild(el("div", "msg err", d.error));
-  if (d.redirect) {
-    var moved = el("div", "redirect");
-    moved.appendChild(el("div", "sig", "↪ Location rewritten"));
-    moved.appendChild(el("div", "mut", d.redirect.from));
-    moved.appendChild(el("div", "", "→ " + d.redirect.to));
-    head.appendChild(moved);
-  }
 
   var tabs = document.querySelectorAll(".tab");
   for (var i = 0; i < tabs.length; i++) {
@@ -1003,7 +1177,8 @@ function renderContent() {
   var box = $("content");
   var top = box.scrollTop;
   clear(box);
-  if (state.tab === "Body") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
+  if (state.tab === "Overview") renderOverview(box, d);
+  else if (state.tab === "Body") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
   else if (state.tab === "Headers") box.appendChild(table(d.reqHeaders));
   else if (state.tab === "Response") {
     box.appendChild(el("div", "sect", "Headers"));
@@ -1020,6 +1195,135 @@ function renderContent() {
   box.scrollTop = top;
 }
 
+function rows(pairs) {
+  var t = el("table");
+  pairs.forEach(function (p) {
+    if (p[1] === null || p[1] === undefined || p[1] === "") return;
+    var tr = el("tr");
+    tr.appendChild(el("th", "", p[0]));
+    tr.appendChild(el("td", "", p[1]));
+    t.appendChild(tr);
+  });
+  return t;
+}
+function clock(ms) {
+  var d = new Date(ms);
+  function two(n) { return (n < 10 ? "0" : "") + n; }
+  return two(d.getHours()) + ":" + two(d.getMinutes()) + ":" + two(d.getSeconds()) + "." + String(d.getMilliseconds()).padStart(3, "0");
+}
+function answeredBy(d) {
+  if (d.origin === null) return "waiting for an answer";
+  if (d.origin === "duto") return d.access && d.access.kind === "denied" ? "duto (tunnel password)" : "duto (nothing answered on localhost)";
+  var t = state.tunnels.filter(function (x) { return x.key === d.tunnel; })[0];
+  return t && t.port ? "your app on localhost:" + t.port : "your app";
+}
+function accessText(a) {
+  if (!a) return null;
+  if (a.kind === "user") return "password, user " + a.user;
+  if (a.kind === "allow") return "allowed: " + a.reason;
+  return "denied";
+}
+function attrsText(attrs) {
+  return Object.keys(attrs).map(function (k) { return attrs[k] === true ? k : k + "=" + attrs[k]; }).join("; ");
+}
+
+function renderOverview(box, d) {
+  var ov = el("div", "ov");
+  d.issues.forEach(function (i) {
+    var card = el("div", "issue " + i.level);
+    card.appendChild(el("b", "", i.title));
+    card.appendChild(el("span", "", i.detail));
+    ov.appendChild(card);
+  });
+
+  if (d.flow.length > 0) {
+    ov.appendChild(el("div", "sect", "Flow"));
+    var flow = el("div", "flow");
+    d.flow.forEach(function (s) {
+      var b = el("button", "step" + (s.id === d.id ? " cur" : ""));
+      b.type = "button";
+      b.appendChild(el("span", "mut", "#" + s.id));
+      b.appendChild(el("span", "m", s.method));
+      b.appendChild(el("span", "", s.path));
+      var st = statusInfo(s);
+      var sp = el("span", "", st.text);
+      sp.style.color = st.color;
+      b.appendChild(sp);
+      b.addEventListener("click", function () { select(s.id); });
+      flow.appendChild(b);
+    });
+    ov.appendChild(flow);
+  }
+
+  ov.appendChild(el("div", "sect", "Request"));
+  var timing = d.durationMs === null || d.durationMs === undefined ? null : d.durationMs + " ms";
+  ov.appendChild(rows([
+    ["Answered by", answeredBy(d)],
+    ["Started", clock(d.startedAt)],
+    ["Total time", timing],
+    ["First byte", d.ttfbMs === undefined ? null : d.ttfbMs + " ms"],
+    ["Size", d.status === null ? null : size(d.bytes)],
+    ["Data center", d.edge ? edgeLabel(d.edge).replace(/^via /, "") : null]
+  ]));
+
+  var changes = (d.changes || []).map(function (c) { return [c.label, c.value + " · " + c.reason]; });
+  if (changes.length > 0 || d.redirect || d.access) {
+    ov.appendChild(el("div", "sect", "Changed by Duto"));
+    ov.appendChild(rows(changes.concat([
+      ["Location rewritten", d.redirect ? d.redirect.from + " → " + d.redirect.to : null],
+      ["Access", accessText(d.access)]
+    ])));
+  }
+
+  if (d.location || d.redirect) {
+    ov.appendChild(el("div", "sect", "Redirect"));
+    ov.appendChild(rows([["Location", d.location || (d.redirect && d.redirect.to)]]));
+  }
+
+  ov.appendChild(el("div", "sect", "Client"));
+  ov.appendChild(rows([["IP", d.client.ip], ["Country", d.client.country], ["User agent", d.client.userAgent]]));
+
+  if (d.query.length > 0) {
+    ov.appendChild(el("div", "sect", "Query"));
+    ov.appendChild(rows(d.query.map(function (q) { return [q.name, q.value || " "]; })));
+  }
+  if (d.cookies.sent.length > 0) {
+    ov.appendChild(el("div", "sect", "Cookies sent"));
+    ov.appendChild(rows(d.cookies.sent.map(function (c) { return [c.name, c.value || " "]; })));
+  }
+  if (d.cookies.set.length > 0) {
+    ov.appendChild(el("div", "sect", "Cookies set"));
+    ov.appendChild(rows(d.cookies.set.map(function (c) {
+      var a = attrsText(c.attrs);
+      return [c.name, (c.value || "\"\"") + (a ? "  ·  " + a : "")];
+    })));
+  }
+  box.appendChild(ov);
+}
+
+function exportHar() {
+  var ids = visible().map(function (it) { return it.id; });
+  if (ids.length === 0) return showMsg("Nothing to export.", true);
+  fetch("/api/har?ids=" + ids.join(","), { headers: { "X-Duto-Inspector": TOKEN }, cache: "no-store" }).then(function (r) {
+    if (r.status === 403) { ended(); throw new Error("403"); }
+    return r.blob();
+  }).then(function (blob) {
+    var a = document.createElement("a");
+    a.href = URL.createObjectURL(blob);
+    a.download = "duto-" + new Date().toISOString().replace(/[:.]/g, "-") + ".har";
+    document.body.appendChild(a);
+    a.click();
+    a.remove();
+    setTimeout(function () { URL.revokeObjectURL(a.href); }, 1000);
+  }).catch(fail);
+}
+
+function toggleClear() {
+  if (state.clearedAfter > 0) state.clearedAfter = 0;
+  else state.clearedAfter = state.items.reduce(function (m, it) { return Math.max(m, it.id); }, 0);
+  renderList();
+}
+
 function table(h) {
   var keys = Object.keys(h || {});
   if (keys.length === 0) return el("div", "note", "No headers.");
@@ -1195,11 +1499,9 @@ function connect() {
     banner("Disconnected from the session.");
     if (es.readyState === 2) probe();
   });
-  es.addEventListener("changed", function (ev) {
-    var ids = [];
-    try { ids = JSON.parse(ev.data).ids || []; } catch (e) {}
+  es.addEventListener("changed", function () {
     loadList();
-    if (state.selected !== null && (ids.length === 0 || ids.indexOf(state.selected) >= 0)) loadDetail(state.selected);
+    if (state.selected !== null) loadDetail(state.selected);
   });
 }
 function probe() {
@@ -1219,6 +1521,13 @@ function init() {
     });
   }
   $("filter").addEventListener("input", renderList);
+  $("clear").addEventListener("click", toggleClear);
+  $("har").addEventListener("click", exportHar);
+  $("helpBtn").addEventListener("click", function () {
+    var h = $("help");
+    h.hidden = !h.hidden;
+    $("helpBtn").setAttribute("aria-expanded", h.hidden ? "false" : "true");
+  });
   $("replay").addEventListener("click", replay);
   $("copyBody").addEventListener("click", function () {
     var b = state.detail ? copyable(state.detail) : { text: null };
@@ -1253,7 +1562,7 @@ function init() {
 init();
 `;
 function inspectorPage(nonce) {
-  const tabs = ["Body", "Headers", "Response", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
+  const tabs = ["Overview", "Body", "Headers", "Response", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -1269,8 +1578,21 @@ function inspectorPage(nonce) {
   <div class="banner" id="banner" role="status" hidden></div>
   <div class="main">
     <div class="side">
-      <input class="search" id="filter" type="search" placeholder="filter\u2026" aria-label="Filter requests" autocomplete="off" spellcheck="false">
+      <input class="search" id="filter" type="search" placeholder="filter\u2026 (status:4xx is:redirect)" aria-label="Filter requests" autocomplete="off" spellcheck="false">
+      <div class="chips" id="chips"></div>
+      <div class="help" id="help" hidden>
+        <span><code>status:404</code> <code>status:5xx</code> <code>status:&gt;=400</code></span>
+        <span><code>method:post</code> <code>path:/api</code> <code>tunnel:web</code> <code>client:1.2.3.4</code></span>
+        <span><code>is:error</code> <code>is:redirect</code> <code>is:rewritten</code> <code>is:issue</code> <code>is:duto</code> <code>is:ws</code> <code>is:pending</code></span>
+        <span><code>duration:&gt;500ms</code> <code>duration:&gt;=1s</code></span>
+        <span>Start a term with <code>-</code> to exclude it. All terms must match.</span>
+      </div>
       <div class="list" id="list" role="listbox" aria-label="Requests"></div>
+      <div class="sidebar-foot">
+        <button type="button" class="btn" id="clear">Clear</button>
+        <button type="button" class="btn" id="har">Export HAR</button>
+        <button type="button" class="btn" id="helpBtn" aria-expanded="false" aria-controls="help">Filter syntax</button>
+      </div>
     </div>
     <div class="detail">
       <div class="empty" id="none">Select a request from the list.</div>
@@ -1311,7 +1633,7 @@ function replayBlock(r) {
   if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Binary body is not stored; cannot replay.";
   return null;
 }
-var HOP_BY_HOP_AND_BODY_HEADERS = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
+var HOP_BY_HOP_AND_BODY_HEADERS = new Set(FRAMING_HEADERS);
 function replayHeaders(r) {
   const out = {};
   for (const [k, v] of Object.entries(r.reqHeaders)) if (!HOP_BY_HOP_AND_BODY_HEADERS.has(k.toLowerCase())) out[k] = v;
@@ -1320,8 +1642,27 @@ function replayHeaders(r) {
   return out;
 }
 
+// src/inspector/cookies.ts
+function pair(part) {
+  const i = part.indexOf("=");
+  return i < 0 ? [part.trim(), null] : [part.slice(0, i).trim(), part.slice(i + 1).trim()];
+}
+function parseSetCookie(line) {
+  const [first3 = "", ...rest] = line.split(";");
+  const [name, value] = pair(first3);
+  const attrs = {};
+  for (const part of rest) {
+    const [key, v] = pair(part);
+    if (key) attrs[key.toLowerCase()] = v ?? true;
+  }
+  return { name, value: value ?? "", attrs };
+}
+function parseCookieHeader(header) {
+  return header.split(";").map((part) => pair(part)).filter(([name]) => name !== "").map(([name, value]) => ({ name, value: value ?? "" }));
+}
+
 // src/inspector/curl.ts
-var SKIP = /* @__PURE__ */ new Set(["host", "content-length", "transfer-encoding", "connection", "keep-alive", "expect", "upgrade", "te", "trailer", "proxy-connection"]);
+var SKIP = /* @__PURE__ */ new Set(["host", ...FRAMING_HEADERS]);
 var TUNNEL_ADDED = /* @__PURE__ */ new Set(["cdn-loop", "x-forwarded-for", "x-forwarded-proto", "x-real-ip", "true-client-ip"]);
 var skip = (name) => {
   const k = name.toLowerCase();
@@ -1340,6 +1681,209 @@ function toCurl(r, o) {
   return parts.join(" \\\n  ");
 }
 
+// src/inspector/diagnose.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "::1"]);
+var LINKABLE = /html|javascript|json|css|xml/i;
+var LOCAL_LINK = /https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?/gi;
+function isLocalHost(host) {
+  const h = host.toLowerCase();
+  return LOCAL_HOSTS.has(h) || h.endsWith(".localhost");
+}
+function absoluteUrl(value) {
+  if (!/^https?:\/\//i.test(value)) return null;
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function originOf(r) {
+  if (r.error || r.access?.kind === "denied") return "duto";
+  return r.status === null ? null : "app";
+}
+function upstreamIssues(r, ctx) {
+  const out = [];
+  if (r.error) {
+    out.push({ level: "error", title: `Nothing is listening on localhost:${ctx.port ?? "?"}`, detail: `${r.error}. Start the server, then replay this request.` });
+  }
+  if (r.access?.kind === "denied") {
+    out.push({ level: "info", title: "Blocked by the tunnel password", detail: "duto answered before the request reached your app." });
+  }
+  return out;
+}
+function redirectIssues(r, ctx) {
+  const location = r.resHeaders.location;
+  const url = location ? absoluteUrl(location) : null;
+  if (!url) return [];
+  if (isLocalHost(url.hostname)) {
+    return [
+      {
+        level: "warn",
+        title: "Redirect to a local address",
+        detail: `Location is ${location}, which only opens on this machine. Build URLs from the request's Host header, or run duto with --host.`
+      }
+    ];
+  }
+  if (url.protocol === "http:" && ctx.publicHost && url.hostname.toLowerCase() === ctx.publicHost) {
+    return [
+      {
+        level: "warn",
+        title: "Redirect drops to http",
+        detail: `Location is ${location}. duto.dev only serves https, so the browser takes an extra hop and loses POST bodies. Have the app trust X-Forwarded-Proto.`
+      }
+    ];
+  }
+  return [];
+}
+function cookieIssues(r, ctx) {
+  const out = [];
+  for (const line of r.resSetCookies ?? []) {
+    const c = parseSetCookie(line);
+    const domain = typeof c.attrs.domain === "string" ? c.attrs.domain.replace(/^\./, "").toLowerCase() : null;
+    const host = ctx.publicHost;
+    if (domain && host && host !== domain && !host.endsWith(`.${domain}`)) {
+      out.push({ level: "warn", title: `Cookie "${c.name}" is dropped`, detail: `Domain=${c.attrs.domain} does not match ${host}. Remove Domain, or set it to ${host}.` });
+    } else if (typeof c.attrs.samesite === "string" && c.attrs.samesite.toLowerCase() === "none" && c.attrs.secure === void 0) {
+      out.push({ level: "warn", title: `Cookie "${c.name}" is dropped`, detail: "SameSite=None needs Secure." });
+    }
+  }
+  return out;
+}
+function corsIssues(r, ctx) {
+  const origin = r.reqHeaders.origin;
+  if (!origin || r.status === null || ctx.publicHost && origin.toLowerCase() === `https://${ctx.publicHost}`) return [];
+  const allowed = r.resHeaders["access-control-allow-origin"];
+  const ok2 = allowed === "*" || allowed === origin;
+  const wanted = r.reqHeaders["access-control-request-method"];
+  if (r.method === "OPTIONS" && wanted) {
+    if (r.status < 400 && ok2) return [];
+    return [{ level: "error", title: "CORS preflight failed", detail: `The browser will not send the ${wanted} from ${origin}. Answer OPTIONS with 2xx and Access-Control-Allow-Origin.` }];
+  }
+  if (ok2) return [];
+  const detail2 = allowed ? `Access-Control-Allow-Origin is ${allowed}, not ${origin}.` : `No Access-Control-Allow-Origin for ${origin}.`;
+  return [{ level: "warn", title: "The browser blocks this response (CORS)", detail: detail2 }];
+}
+function bodyIssues(r) {
+  if (!r.resBody || !LINKABLE.test(r.resHeaders["content-type"] ?? "")) return [];
+  const links = r.resBody.match(LOCAL_LINK);
+  if (!links) return [];
+  const first3 = links[0];
+  const detail2 = links.length === 1 ? `1 link points to ${first3}. It only opens on this machine.` : `${links.length} links point to ${first3}. They only open on this machine.`;
+  return [{ level: "warn", title: "The response links to localhost", detail: detail2 }];
+}
+function diagnose(r, ctx) {
+  return [...upstreamIssues(r, ctx), ...redirectIssues(r, ctx), ...cookieIssues(r, ctx), ...corsIssues(r, ctx), ...bodyIssues(r)];
+}
+
+// src/inspector/flows.ts
+var FLOW_WINDOW_MS = 3e4;
+function clientOf(r) {
+  const direct = r.reqHeaders["cf-connecting-ip"];
+  if (direct) return direct;
+  const forwarded = r.reqHeaders["x-forwarded-for"]?.split(",")[0]?.trim();
+  return forwarded || null;
+}
+var clientKey = (r) => `${clientOf(r) ?? ""}|${r.reqHeaders["user-agent"] ?? ""}`;
+function redirectTarget(r, publicHost) {
+  const location = r.resHeaders.location;
+  if (!location || r.status === null || r.status < 300 || r.status >= 400) return null;
+  const base = `https://${publicHost ?? "duto.invalid"}`;
+  let url;
+  try {
+    url = new URL(location, base + r.path);
+  } catch {
+    return null;
+  }
+  if (url.origin !== base) return null;
+  return url.pathname + url.search;
+}
+function linkFlows(records, publicHostOf) {
+  const ordered = [...records].sort((a, b) => a.id - b.id);
+  const links = /* @__PURE__ */ new Map();
+  const link = (id, patch) => links.set(id, { ...links.get(id), ...patch });
+  ordered.forEach((r, i) => {
+    const target = redirectTarget(r, publicHostOf(r.tunnel));
+    if (target === null) return;
+    const key = clientKey(r);
+    const next = ordered.slice(i + 1).find((n) => n.tunnel === r.tunnel && n.path === target && clientKey(n) === key && n.startedAt - r.startedAt <= FLOW_WINDOW_MS && links.get(n.id)?.prev === void 0);
+    if (!next) return;
+    link(r.id, { next: next.id });
+    link(next.id, { prev: r.id });
+  });
+  return links;
+}
+function flowChain(id, links) {
+  let first3 = id;
+  const seen = /* @__PURE__ */ new Set([id]);
+  for (let p = links.get(first3)?.prev; p !== void 0 && !seen.has(p); p = links.get(first3)?.prev) {
+    seen.add(p);
+    first3 = p;
+  }
+  const chain = [first3];
+  for (let n = links.get(first3)?.next; n !== void 0 && !chain.includes(n); n = links.get(n)?.next) chain.push(n);
+  return chain;
+}
+
+// src/inspector/har.ts
+var HTTP = "HTTP/1.1";
+var HAR_MASK = "\u2022\u2022\u2022 (duto.yml)";
+function maskedNames(r) {
+  return new Set((r.headerChanges ?? []).filter((c) => c.source === "headers" && c.kind !== "remove").map((c) => c.name));
+}
+var masked = (list, names) => list.map((h) => names.has(h.name.toLowerCase()) ? { ...h, value: HAR_MASK } : h);
+var headerList = (h) => Object.entries(h).map(([name, value]) => ({ name, value }));
+function harCookie(line) {
+  const c = parseSetCookie(line);
+  return {
+    name: c.name,
+    value: c.value,
+    ...typeof c.attrs.path === "string" && { path: c.attrs.path },
+    ...typeof c.attrs.domain === "string" && { domain: c.attrs.domain },
+    ...c.attrs.httponly !== void 0 && { httpOnly: true },
+    ...c.attrs.secure !== void 0 && { secure: true }
+  };
+}
+function entry(r, publicUrl) {
+  const url = new URL(r.path, publicUrl ?? "http://localhost");
+  const time = r.durationMs ?? 0;
+  const wait = Math.min(r.ttfbMs ?? time, time);
+  const reqType = r.reqHeaders["content-type"] ?? "";
+  const secret = maskedNames(r);
+  const cookies = parseCookieHeader(r.reqHeaders.cookie ?? "");
+  return {
+    startedDateTime: new Date(r.startedAt).toISOString(),
+    time,
+    request: {
+      method: r.websocket ? "GET" : r.method,
+      url: url.toString(),
+      httpVersion: HTTP,
+      headers: masked(headerList(r.reqHeaders), secret),
+      queryString: [...url.searchParams].map(([name, value]) => ({ name, value })),
+      cookies: secret.has("cookie") ? cookies.map((c) => ({ ...c, value: HAR_MASK })) : cookies,
+      headersSize: -1,
+      bodySize: r.reqBodyBytes,
+      ...r.reqBody !== null && { postData: { mimeType: reqType, text: r.reqBody } }
+    },
+    response: {
+      status: r.status ?? 0,
+      statusText: "",
+      httpVersion: HTTP,
+      headers: headerList(r.resHeaders),
+      cookies: (r.resSetCookies ?? []).map(harCookie),
+      content: { size: r.bytes, mimeType: r.resHeaders["content-type"] ?? "", ...r.resBody !== null && { text: r.resBody } },
+      redirectURL: r.resHeaders.location ?? "",
+      headersSize: -1,
+      bodySize: r.bytes
+    },
+    cache: {},
+    timings: { send: 0, wait, receive: time - wait }
+  };
+}
+function toHar(records, publicUrlOf, version) {
+  const entries = [...records].sort((a, b) => a.id - b.id).map((r) => entry(r, publicUrlOf(r.tunnel)));
+  return { log: { version: "1.2", creator: { name: "duto", version }, entries } };
+}
+
 // src/inspector/server.ts
 var DEFAULT_PORT = 4141;
 var PORT_TRIES = 20;
@@ -1350,7 +1894,30 @@ var CURL_BYTES = "The curl body may differ from the one received (non-UTF-8 byte
 var sha = (s) => createHash2("sha256").update(s).digest();
 var constantTimeEqual = (a, b) => timingSafeEqual(sha(a), sha(b));
 var first = (v) => Array.isArray(v) ? v[0] : v;
-function listItem(r) {
+function hostOfUrl(url) {
+  if (!url) return null;
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function viewOf(session) {
+  const tunnels = session.getState().tunnels;
+  const find = (key) => tunnels.find((t) => t.key === key);
+  const urlOf = (key) => find(key)?.url ?? null;
+  const hostOf2 = (key) => hostOfUrl(urlOf(key));
+  return {
+    urlOf,
+    context: (key) => ({ publicHost: hostOf2(key), port: find(key)?.port ?? null }),
+    links: linkFlows(session.records.list(), hostOf2)
+  };
+}
+function isRedirect(r) {
+  return r.status !== null && r.status >= 300 && r.status < 400 && !!r.resHeaders.location;
+}
+function listItem(r, view) {
+  const link = view.links.get(r.id);
   return {
     id: r.id,
     tunnel: r.tunnel,
@@ -1361,12 +1928,35 @@ function listItem(r) {
     bytes: r.bytes,
     startedAt: r.startedAt,
     websocket: r.websocket,
+    origin: originOf(r),
+    issues: diagnose(r, view.context(r.tunnel)).length,
+    client: clientOf(r),
+    ...r.ttfbMs !== void 0 && { ttfbMs: r.ttfbMs },
+    ...isRedirect(r) && { location: r.resHeaders.location },
+    ...link?.prev !== void 0 && { prev: link.prev },
+    ...link?.next !== void 0 && { next: link.next },
     ...r.replayOf !== void 0 && { replayOf: r.replayOf },
     ...r.error !== void 0 && { error: r.error },
-    ...r.redirect !== void 0 && { rewritten: true }
+    ...r.redirect !== void 0 && { rewritten: true },
+    ...r.access !== void 0 && { access: r.access }
   };
 }
-function detail(r, session) {
+function queryOf(path) {
+  try {
+    return [...new URL(path, "http://x").searchParams].map(([name, value]) => ({ name, value }));
+  } catch {
+    return [];
+  }
+}
+function flowOf(r, session, view) {
+  const chain = flowChain(r.id, view.links);
+  if (chain.length < 2) return [];
+  return chain.flatMap((id) => {
+    const step = session.records.get(id);
+    return step ? [{ id, method: step.websocket ? "WS" : step.method, path: step.path, status: step.status }] : [];
+  });
+}
+function detail(r, session, view) {
   const tunnel2 = session.getState().tunnels.find((t) => t.key === r.tunnel);
   const tunnelOpen = !!tunnel2 && (tunnel2.status === "live" || tunnel2.status === "no-listener");
   let curl = null;
@@ -1377,9 +1967,15 @@ function detail(r, session) {
     if (r.reqRaw && !Buffer.from(r.reqBody ?? "", "utf8").equals(r.reqRaw)) curlNote = CURL_BYTES;
   }
   return {
-    ...listItem(r),
+    ...listItem(r, view),
     edge: edgeOf(r.reqHeaders),
     redirect: r.redirect ?? null,
+    changes: (r.headerChanges ?? []).map(describeChange),
+    issues: diagnose(r, view.context(r.tunnel)),
+    client: { ip: clientOf(r), country: r.reqHeaders["cf-ipcountry"] ?? null, userAgent: r.reqHeaders["user-agent"] ?? null },
+    query: queryOf(r.path),
+    cookies: { sent: parseCookieHeader(r.reqHeaders.cookie ?? ""), set: (r.resSetCookies ?? []).map(parseSetCookie) },
+    flow: flowOf(r, session, view),
     reqHeaders: r.reqHeaders,
     resHeaders: r.resHeaders,
     reqBody: r.reqBody,
@@ -1434,7 +2030,7 @@ data: ${JSON.stringify({ ids })}
     res.setHeader("Referrer-Policy", "no-referrer");
     res.setHeader("X-Frame-Options", "DENY");
   };
-  const text = (res, status, body) => {
+  const text2 = (res, status, body) => {
     res.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" });
     res.end(body);
   };
@@ -1445,19 +2041,19 @@ data: ${JSON.stringify({ ids })}
   const handle = (req, res) => {
     base(res);
     const host = first(req.headers.host)?.toLowerCase();
-    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text(res, 403, "Host not allowed.");
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text2(res, 403, "Host not allowed.");
     let url2;
     try {
       url2 = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
     } catch {
-      return text(res, 404, "Not found.");
+      return text2(res, 404, "Not found.");
     }
     const path = url2.pathname;
     const method = req.method ?? "GET";
     const queryToken = url2.searchParams.get("t") ?? "";
     const headerToken = first(req.headers["x-duto-inspector"]) ?? "";
     if (method === "GET" && path === "/") {
-      if (!constantTimeEqual(queryToken, token)) return text(res, 403, NO_TOKEN);
+      if (!constantTimeEqual(queryToken, token)) return text2(res, 403, NO_TOKEN);
       const nonce = randomBytes(16).toString("base64url");
       res.writeHead(200, {
         "Content-Type": "text/html; charset=utf-8",
@@ -1467,8 +2063,8 @@ data: ${JSON.stringify({ ids })}
     }
     const isEvents = method === "GET" && path === "/api/events";
     const detailId = /^\/api\/requests\/([1-9]\d{0,15})(\/replay)?$/.exec(path);
-    const known = method === "GET" && (path === "/api/session" || path === "/api/requests" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
-    if (!known) return text(res, 404, "Not found.");
+    const known = method === "GET" && (path === "/api/session" || path === "/api/requests" || path === "/api/har" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
+    if (!known) return text2(res, 404, "Not found.");
     if (!constantTimeEqual(headerToken, token) && !(isEvents && constantTimeEqual(queryToken, token))) return json(res, 403, { error: NO_TOKEN });
     if (isEvents) {
       res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", Connection: "keep-alive" });
@@ -1479,21 +2075,31 @@ data: ${JSON.stringify({ ids })}
       return;
     }
     if (path === "/api/session") {
-      return json(res, 200, { tunnels: session.getState().tunnels.map((t) => ({ key: t.key, url: t.url, auth: !!t.auth })) });
+      return json(res, 200, { tunnels: session.getState().tunnels.map((t) => ({ key: t.key, url: t.url, auth: !!t.auth, port: t.port })) });
+    }
+    if (path === "/api/requests") {
+      const view = viewOf(session);
+      return json(res, 200, { items: session.records.list().map((r2) => listItem(r2, view)) });
+    }
+    if (path === "/api/har") {
+      const wanted = url2.searchParams.get("ids");
+      const ids = wanted === null ? null : new Set(wanted.split(",").map(Number));
+      const records = session.records.list().filter((r2) => !ids || ids.has(r2.id));
+      res.setHeader("Content-Disposition", 'attachment; filename="duto.har"');
+      return json(res, 200, toHar(records, viewOf(session).urlOf, CLI_VERSION));
     }
-    if (path === "/api/requests") return json(res, 200, { items: session.records.list().map(listItem) });
     const id = Number(detailId[1]);
     if (!Number.isSafeInteger(id)) return json(res, 404, { error: GONE });
     if (method === "POST") return json(res, 200, session.replay(id));
     const r = session.records.get(id);
     if (!r) return json(res, 404, { error: GONE });
-    return json(res, 200, detail(r, session));
+    return json(res, 200, detail(r, session, viewOf(session)));
   };
   const server = createServer((req, res) => {
     try {
       handle(req, res);
     } catch {
-      if (!res.headersSent) text(res, 500, "Internal error.");
+      if (!res.headersSent) text2(res, 500, "Internal error.");
       else res.end();
     }
   });
@@ -1710,6 +2316,62 @@ function cors401(origin) {
 import { Agent, createServer as createServer2, request } from "http";
 import { connect as connect2 } from "net";
 
+// src/session/delivery.ts
+function text(h, name) {
+  if (!Object.hasOwn(h, name)) return void 0;
+  const v = h[name];
+  return Array.isArray(v) ? v.join(", ") : v;
+}
+function dropUntrustedForwarded(out, changes) {
+  for (const name of UNTRUSTED_VISITOR_HEADERS) {
+    const from = text(out, name);
+    if (from === void 0) continue;
+    delete out[name];
+    changes.push({ kind: "remove", name, from, source: "visitor" });
+  }
+}
+function swapHost(out, host, changes) {
+  changes.push({ kind: "replace", name: "host", from: out.host ?? "", to: host, source: "host" });
+  out.host = host;
+  const forwarded = text(out, "x-forwarded-host");
+  if (forwarded === void 0) return;
+  delete out["x-forwarded-host"];
+  changes.push({ kind: "remove", name: "x-forwarded-host", from: forwarded, source: "host" });
+}
+function applyHeaders(out, headers, changes) {
+  for (const [name, to] of Object.entries(headers)) {
+    const from = text(out, name);
+    if (to === "") {
+      if (from === void 0) continue;
+      delete out[name];
+      changes.push({ kind: "remove", name, from, source: "headers" });
+    } else {
+      out[name] = to;
+      changes.push(from === void 0 ? { kind: "add", name, to, source: "headers" } : { kind: "replace", name, from, to, source: "headers" });
+    }
+  }
+}
+function stripDutoCredentials(out, stripped, changes) {
+  for (const name of ["x-duto-auth", "authorization"]) {
+    const from = text(out, name);
+    if (from !== void 0 && text(stripped, name) === void 0) changes.push({ kind: "remove", name, from, source: "duto" });
+  }
+  if (text(out, "cookie") !== text(stripped, "cookie")) changes.push({ kind: "remove", name: "cookie", from: TUNNEL_COOKIE, source: "duto" });
+}
+function deliver(h, route) {
+  const changes = [];
+  let out = { ...h };
+  if (!route.trustForwarded) dropUntrustedForwarded(out, changes);
+  if (route.host) swapHost(out, route.host, changes);
+  if (route.headers) applyHeaders(out, route.headers, changes);
+  if (route.auth) {
+    const stripped = route.auth.strip(out);
+    stripDutoCredentials(out, stripped, changes);
+    out = stripped;
+  }
+  return changes.length ? { headers: out, changes } : { headers: h, changes };
+}
+
 // src/session/errorPage.ts
 var esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 function wantsHtml(accept) {
@@ -1818,6 +2480,7 @@ var PREFLIGHT_NO_REPLAY = "CORS preflight cannot be replayed.";
 var TEXT2 = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
 var MAX_BODY = 64 * 1024;
 var LOCAL_AGENT = new Agent({ keepAlive: false });
+var errorText = (err) => err instanceof Error ? err.message || err.code || err.name : String(err);
 function flat(h) {
   const out = {};
   for (const [k, v] of Object.entries(h)) if (v !== void 0) out[k] = Array.isArray(v) ? v.join(", ") : v;
@@ -1876,19 +2539,6 @@ async function localHost(port) {
   hostCache.set(port, { host, at: Date.now() });
   return host;
 }
-function rewrite(h, route) {
-  if (!route.host && !route.headers) return h;
-  const out = { ...h };
-  if (route.host) {
-    out.host = route.host;
-    delete out["x-forwarded-host"];
-  }
-  for (const [k, v] of Object.entries(route.headers ?? {})) {
-    if (v === "") delete out[k];
-    else out[k] = v;
-  }
-  return out;
-}
 var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 function rewriteLocation(location, localHost2, publicHost) {
   const host = escapeRe(localHost2.replace(/:\d+$/, ""));
@@ -1977,10 +2627,6 @@ function deny(req, res, html) {
   res.end(body);
   return { status, out, body };
 }
-function delivered(h, route) {
-  const out = rewrite(h, route);
-  return route.auth ? route.auth.strip(out) : out;
-}
 async function isUp(port) {
   return await probe("127.0.0.1", port) || await probe("::1", port);
 }
@@ -2022,7 +2668,7 @@ async function startProxy(o) {
       await new Promise((r) => setTimeout(r, 50));
     }
   }
-  function record(req, route, headers, websocket, access, noReplay) {
+  function record(req, route, headers, changes, websocket, access, noReplay) {
     const id = nextId++;
     const started = Date.now();
     o.store.add({
@@ -2046,12 +2692,15 @@ async function startProxy(o) {
       truncated: false,
       resTruncated: false,
       ...access && { access },
-      ...noReplay && { noReplay }
+      ...noReplay && { noReplay },
+      ...changes.length && { headerChanges: changes }
     });
     return { id, started };
   }
   function trackResponse(id, started, up, reqCap) {
     const resCap = new Capture(TEXT2.test(up.headers["content-type"] ?? ""), max);
+    const ttfbMs = Date.now() - started;
+    const setCookies = up.headers["set-cookie"];
     let bytes = 0;
     up.on("data", (c) => {
       bytes += c.length;
@@ -2062,8 +2711,10 @@ async function startProxy(o) {
       () => o.store.update(id, {
         status: up.statusCode ?? null,
         durationMs: Date.now() - started,
+        ttfbMs,
         bytes,
         resHeaders: flat(up.headers),
+        ...setCookies?.length && { resSetCookies: setCookies },
         resBody: resCap.text(),
         truncated: !!reqCap?.truncated || resCap.truncated,
         resTruncated: resCap.truncated,
@@ -2100,11 +2751,18 @@ async function startProxy(o) {
       reqComplete: true,
       truncated: false,
       resTruncated: false,
-      replayOf: r.id
+      replayOf: r.id,
+      ...r.headerChanges && { headerChanges: r.headerChanges }
     });
     void (async () => {
       const host = await localHost(route.port);
-      const upstream = request({ host, port: route.port, agent: LOCAL_AGENT, method: r.method, path: r.path, headers }, (up) => trackResponse(newId, started, up));
+      let upstream;
+      try {
+        upstream = request({ host, port: route.port, agent: LOCAL_AGENT, method: r.method, path: r.path, headers }, (up) => trackResponse(newId, started, up));
+      } catch (err) {
+        o.store.update(newId, { status: 502, durationMs: Date.now() - started, error: errorText(err) });
+        return;
+      }
       upstream.on("error", (err) => o.store.update(newId, { status: 503, durationMs: Date.now() - started, error: err.message || err.code || err.name }));
       upstream.end(r.reqRaw ?? void 0);
     })();
@@ -2130,42 +2788,55 @@ async function startProxy(o) {
     }
     const preflight = !!route.auth && isPreflight(req.method, req.headers);
     const access = route.auth && !preflight ? route.auth.access(req.headers) : void 0;
-    const headers = delivered(req.headers, route);
+    const { headers, changes } = deliver(req.headers, route);
     if (access?.kind === "denied") {
       const html = wantsHtml(req.headers.accept);
-      const { id: id2, started: started2 } = record(req, route, headers, false, html ? void 0 : access, DENIED_NO_REPLAY);
+      const { id: id2, started: started2 } = record(req, route, headers, changes, false, html ? void 0 : access, DENIED_NO_REPLAY);
       const { status, out, body } = deny(req, res, html);
       o.store.update(id2, { status, durationMs: Date.now() - started2, bytes: Buffer.byteLength(body), resHeaders: out });
       return;
     }
-    const { id, started } = record(req, route, headers, false, access, preflight ? PREFLIGHT_NO_REPLAY : void 0);
+    const { id, started } = record(req, route, headers, changes, false, access, preflight ? PREFLIGHT_NO_REPLAY : void 0);
     const reqCap = new Capture(TEXT2.test(req.headers["content-type"] ?? ""), max);
+    const recordArrival = () => o.store.update(id, { reqComplete: true, reqRaw: reqCap.truncated ? null : reqCap.raw(), reqBodyBytes: reqCap.total, reqTruncated: reqCap.truncated, reqBody: reqCap.text() });
     req.pause();
     const host = await localHost(route.port);
-    const upstream = request(
-      { host, port: route.port, agent: LOCAL_AGENT, method: req.method, path: req.url, headers },
-      (up) => {
-        if (preflight) {
-          const out = preflightHeaders(up.headers);
-          res.writeHead(up.statusCode ?? 502, out);
-          res.end();
-          up.on("end", () => o.store.update(id, { status: up.statusCode ?? null, durationMs: Date.now() - started, bytes: 0, resHeaders: flat(out) }));
-          up.resume();
-          return;
-        }
-        if (route.host && route.rewriteRedirects !== false && typeof up.headers.location === "string") {
-          const from = up.headers.location;
-          const to = rewriteLocation(from, route.host, hostOf(req));
-          if (to !== from) {
-            up.headers.location = to;
-            o.store.update(id, { redirect: { from, to } });
+    let upstream;
+    try {
+      upstream = request(
+        { host, port: route.port, agent: LOCAL_AGENT, method: req.method, path: req.url, headers },
+        (up) => {
+          if (preflight) {
+            const out = preflightHeaders(up.headers);
+            res.writeHead(up.statusCode ?? 502, out);
+            res.end();
+            up.on("end", () => o.store.update(id, { status: up.statusCode ?? null, durationMs: Date.now() - started, bytes: 0, resHeaders: flat(out) }));
+            up.resume();
+            return;
+          }
+          if (route.host && route.rewriteRedirects !== false && typeof up.headers.location === "string") {
+            const from = up.headers.location;
+            const to = rewriteLocation(from, route.host, hostOf(req));
+            if (to !== from) {
+              up.headers.location = to;
+              o.store.update(id, { redirect: { from, to } });
+            }
           }
+          res.writeHead(up.statusCode ?? 502, up.statusMessage, up.headers);
+          trackResponse(id, started, up, reqCap);
+          up.pipe(res);
         }
-        res.writeHead(up.statusCode ?? 502, up.statusMessage, up.headers);
-        trackResponse(id, started, up, reqCap);
-        up.pipe(res);
-      }
-    );
+      );
+    } catch (err) {
+      req.on("data", (c) => reqCap.push(c));
+      req.on("end", recordArrival);
+      req.resume();
+      const msg = `Duto could not forward this request: ${errorText(err)}`;
+      res.writeHead(502, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+      res.end(req.method === "HEAD" ? void 0 : msg);
+      o.store.update(id, { status: 502, durationMs: Date.now() - started, bytes: Buffer.byteLength(msg), error: errorText(err) });
+      return;
+    }
     res.on("close", () => {
       if (!res.writableFinished) upstream.destroy();
     });
@@ -2180,7 +2851,7 @@ async function startProxy(o) {
       } else res.destroy();
       o.store.update(id, { status: 503, durationMs: Date.now() - started, bytes: res.headersSent ? 0 : Buffer.byteLength(msg), error: err.message || err.code || err.name, reqBody: reqCap.text() });
     });
-    req.on("end", () => o.store.update(id, { reqComplete: true, reqRaw: reqCap.truncated ? null : reqCap.raw(), reqBodyBytes: reqCap.total, reqTruncated: reqCap.truncated, reqBody: reqCap.text() }));
+    req.on("end", recordArrival);
     if (preflight) {
       req.resume();
       upstream.end();
@@ -2194,8 +2865,8 @@ async function startProxy(o) {
     const route = await routeFor(req);
     if (!route) return void client.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
     const access = route.auth?.access(req.headers);
-    const headers = delivered(req.headers, route);
-    const { id, started } = record(req, route, headers, true, access, access?.kind === "denied" ? DENIED_NO_REPLAY : void 0);
+    const { headers, changes } = deliver(req.headers, route);
+    const { id, started } = record(req, route, headers, changes, true, access, access?.kind === "denied" ? DENIED_NO_REPLAY : void 0);
     if (access?.kind === "denied") {
       client.end(WS_DENIED);
       o.store.update(id, { status: 401, durationMs: Date.now() - started });
@@ -2453,7 +3124,7 @@ var Session = class {
   }
   blank(spec, adHoc) {
     this.specs.set(keyOf(spec), spec);
-    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
@@ -2482,7 +3153,7 @@ var Session = class {
       t.hostname = res.hostname;
       t.endpointId = res.endpointId;
       t.error = null;
-      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, auth });
+      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth });
       t.status = await isPortListening(t.port) ? "live" : "no-listener";
       this.ensureCloudflared(res.tunnelToken);
       this.emit();
@@ -2664,8 +3335,8 @@ function listFlag(raw) {
 }
 function parseAuthFlags(raw) {
   const out = [];
-  for (const entry of listFlag(raw)) {
-    const r = parseCredential(entry);
+  for (const entry2 of listFlag(raw)) {
+    const r = parseCredential(entry2);
     if (!r.ok) fail2(r.reason === "password" ? "Password must be 8 to 128 characters" : r.reason === "user" ? "Invalid user: 1 to 128 characters, no spaces" : "Invalid credential: use user:password");
     if (out.some((c) => c.user === r.cred.user)) fail2(`Duplicate user "${r.cred.user}"`);
     out.push(r.cred);
@@ -2702,15 +3373,17 @@ async function runSession(specs, source, flags) {
       inspectorError = err instanceof Error ? err.message : String(err);
     }
   }
+  const warnings = credentialWarnings(specs);
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-MZMQ6ADN.js");
-    const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update);
+    const { runFullscreen } = await import("./fullscreen-MSVJF43W.js");
+    const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
   console.log(`${mark()} ${paint("muted", `${CLI_VERSION} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
   if (inspector) console.log(paint("muted", `inspector: ${inspector.openUrl}`));
   if (inspectorError) console.log(warn(`inspector failed to start: ${inspectorError}`));
+  for (const w of warnings) console.log(warn(w));
   void update.then((latest) => latest && console.log(warn(updateLine(latest))));
   const stopLog = runPlain(session, (l) => console.log(l));
   const stopped = new Promise((resolve) => {