@dutodev/cli 1.6.1 → 1.8.0

package/README.md

@@ -34,7 +34,7 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
    duto 3000 --name web       # https://web-<user>.duto.dev
    ```
 
-Every name you use with `--name` is reserved for you and keeps the same URL. Names take lowercase letters and numbers only, no hyphens.
+Every name you use with `--name` keeps the same URL, and only you can use it. Names take lowercase letters and numbers only, no hyphens. The account limit counts named tunnels online at once: closed ones do not count, and names unused for 30 days are released.
 
 ## Several tunnels: `duto.yml`
 
@@ -49,6 +49,8 @@ tunnels:
 
 All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.dev`) from the same file.
 
+**Edit while it runs.** Save `duto.yml` and the change applies right away, without restarting: new tunnels open, removed ones close, and a new `port`, `host`, `headers`, `auth` or `allow` counts from the next request, on the same URL. Visitors signed in with a password stay signed in while their user is still in `auth`. A save with a mistake changes nothing: the tunnels keep the last valid config and the screen shows the error with its line until you save a fixed file. Tunnels opened with `n` on the screen are left alone. Saving `.env` or `.env.local` applies the file again with the new values.
+
 ### Host and headers
 
 By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.dev`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
@@ -140,7 +142,7 @@ tunnels:
 ```
 
 - `auth` is a list of `user:password`. Use one pair per person. The first `:` separates the user from the password; the password is 8 to 128 characters.
-- `${VAR}` reads an environment variable. Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
+- `${VAR}` reads an environment variable, or the `.env` and `.env.local` next to `duto.yml` (`.env.local` wins over `.env`; a variable exported in the shell wins over both). Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
 - In a one-line list in brackets, `${VAR}` needs quotes (`auth: ["client:${CLIENT_PASSWORD}"]`), because `{` is special in YAML. In a block list, as above, it does not.
 - On the command line, for a single tunnel: `duto 3000 --auth client:my-password1 --allow stripe`. Both options can be repeated. They only work with a port; with a `duto.yml`, put them in the file.
 - Careful: a password passed to `--auth` ends up in your shell history and is visible to anyone who runs `ps` on the machine. For anything beyond a quick test, use `duto.yml` with `${VAR}`.
@@ -154,7 +156,7 @@ People get in one of these ways:
 | `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.dev/` (`Authorization: Basic`) |
 | An API that already uses `Authorization: Bearer` | Send `X-Duto-Auth: client:password`; the `Bearer` goes through to the app untouched |
 
-Without credentials, a browser is sent to the sign-in page and other clients get `401`. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
+Without credentials, a browser is sent to the sign-in page and other clients get `401`. After 10 wrong passwords from one address in 5 minutes, that address is locked out for the rest of the window (the sign-in page answers `429` with `Retry-After`, other clients keep getting `401`). After 100 wrong passwords from all addresses, every password attempt is locked out the same way. A browser that already signed in keeps working. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
 **Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 

package/dist/{chunk-DUC4RSBW.js → chunk-QFM4MUED.js}

@@ -1,5 +1,27 @@
 #!/usr/bin/env node
 
+// src/ui/brand.ts
+function colorOn(stream = process.stdout) {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
+  return Boolean(stream.isTTY);
+}
+var SGR = {
+  signal: "38;2;45;212;191",
+  muted: "38;2;138;143;139",
+  strong: "1",
+  ok: "38;2;74;222;128",
+  warn: "38;2;250;204;21",
+  err: "38;2;248;113;113"
+};
+function paint(tone, text, stream) {
+  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text}\x1B[0m` : text;
+}
+var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
+var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
+var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
+var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+
 // ../shared/src/names.ts
 var EMAIL_SENDING_SUBDOMAINS = ["send"];
 var RESERVED_NAMES = [
@@ -477,6 +499,95 @@ function loadConfig() {
   return fresh;
 }
 
+// src/ui/format.ts
+function statusColor(status) {
+  if (status === null) return "muted";
+  if (status === 101) return "signal";
+  if (status >= 500) return "err";
+  if (status >= 400) return "warn";
+  if (status >= 300) return "muted";
+  return "ok";
+}
+function formatDuration(ms) {
+  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatTime(ms) {
+  const d = new Date(ms);
+  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
+}
+function localLabel(t) {
+  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
+}
+
+// src/ui/plain.ts
+var KEEPING_LAST_CONFIG = "Tunnels keep the last valid config.";
+function runPlain(session, out) {
+  const announced = /* @__PURE__ */ new Map();
+  const failed = /* @__PURE__ */ new Set();
+  const printed = /* @__PURE__ */ new Set();
+  let configError = null;
+  let reloads = 0;
+  const onTunnels = (state) => {
+    const keys = new Set(state.tunnels.map((t) => t.key));
+    for (const key of [...announced.keys()]) {
+      if (keys.has(key)) continue;
+      announced.delete(key);
+      out(`${paint("muted", "\u25CB")} ${key}  closed`);
+    }
+    for (const key of [...failed]) if (!keys.has(key)) failed.delete(key);
+    for (const t of state.tunnels) {
+      if ((t.status === "live" || t.status === "no-listener") && t.url) {
+        const line = `${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`;
+        if (announced.get(t.key) !== line) {
+          announced.set(t.key, line);
+          out(line);
+        }
+      }
+      if (t.status !== "failed") failed.delete(t.key);
+      if (t.status === "failed" && t.error && !failed.has(t.key)) {
+        failed.add(t.key);
+        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
+      }
+    }
+  };
+  const onConfig = (state) => {
+    const { error, warnings } = state.config;
+    if (error && error !== configError) out(`${paint("err", "\u2716")} ${error} ${KEEPING_LAST_CONFIG}`);
+    configError = error;
+    if (state.config.reloads === reloads) return;
+    reloads = state.config.reloads;
+    out(`${paint("signal", "\u21BB")} ${state.source} reloaded`);
+    for (const w of warnings) out(paint("warn", w));
+  };
+  const onState = () => {
+    const state = session.getState();
+    onTunnels(state);
+    onConfig(state);
+  };
+  const onRecords = () => {
+    for (const r of [...session.records.list()].reverse()) {
+      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
+      printed.add(r.id);
+      const method = r.websocket ? "WS" : r.method;
+      out(
+        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
+      );
+    }
+  };
+  const offState = session.subscribe(onState);
+  const offRecords = session.records.subscribe(onRecords);
+  onState();
+  return () => {
+    offState();
+    offRecords();
+  };
+}
+
 // src/updates.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2 } from "path";
@@ -575,32 +686,12 @@ function bodyNote(r, side) {
   return null;
 }
 
-// src/ui/format.ts
-function statusColor(status) {
-  if (status === null) return "muted";
-  if (status === 101) return "signal";
-  if (status >= 500) return "err";
-  if (status >= 400) return "warn";
-  if (status >= 300) return "muted";
-  return "ok";
-}
-function formatDuration(ms) {
-  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatBytes(n) {
-  if (n < 1024) return `${n} B`;
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-  return `${(n / 1024 / 1024).toFixed(1)} MB`;
-}
-function formatTime(ms) {
-  const d = new Date(ms);
-  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-}
-function localLabel(t) {
-  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
-}
-
 export {
+  paint,
+  mark,
+  ok,
+  fail,
+  warn,
   MAX_NAME,
   normalizeName,
   validateName,
@@ -628,6 +719,8 @@ export {
   formatBytes,
   formatTime,
   localLabel,
+  KEEPING_LAST_CONFIG,
+  runPlain,
   checkForUpdate,
   updateLine
 };

package/dist/{fullscreen-MSVJF43W.js → fullscreen-Q3RGW6NJ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  KEEPING_LAST_CONFIG,
   MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
@@ -15,7 +16,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-DUC4RSBW.js";
+} from "./chunk-QFM4MUED.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -348,6 +349,12 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
     const t = setTimeout(() => setMessage(null), 4e3);
     return () => clearTimeout(t);
   }, [message]);
+  const reloads = state.config.reloads;
+  const reloadWarnings = state.config.warnings;
+  useEffect(() => {
+    if (reloads === 0) return;
+    setMessage({ text: [`\u21BB ${state.source} reloaded`, ...reloadWarnings].join("  "), tone: reloadWarnings.length ? "warn" : "signal" });
+  }, [reloads]);
   const inQr = mode.kind === "qr";
   useEffect(() => {
     if (!inQr) return;
@@ -467,7 +474,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
   });
   const live = state.tunnels.filter((t) => t.status === "live").length;
   const conn = state.connection === "online" ? { text: "connected \u25CF", color: C.signal } : state.connection === "connecting" ? { text: "connecting\u2026", color: C.muted } : { text: "reconnecting\u2026", color: C.warn };
-  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0));
+  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0) - (state.config.error ? 1 : 0));
   const detailRecord = mode.kind === "detail" ? all.find((r) => r.id === mode.id) : void 0;
   const qrTunnel = mode.kind === "qr" ? state.tunnels.find((t) => t.key === mode.key) : void 0;
   return /* @__PURE__ */ jsxs6(Box5, { flexDirection: "column", width, children: [
@@ -493,6 +500,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
       /* @__PURE__ */ jsx6(Text6, { color: conn.color, children: conn.text })
     ] }),
     update && /* @__PURE__ */ jsx6(Text6, { color: C.warn, children: updateLine(update) }),
+    state.config.error && /* @__PURE__ */ jsx6(Text6, { color: C.err, children: `${state.config.error} ${KEEPING_LAST_CONFIG}` }),
     /* @__PURE__ */ jsx6(Text6, { children: " " }),
     /* @__PURE__ */ jsx6(TunnelTable, { tunnels: state.tunnels, selected: selTun, focused: focus === "tunnels" }),
     inspector && /* @__PURE__ */ jsx6(Text6, { color: C.muted, children: `inspector  ${inspector.url}` }),

package/dist/index.js

@@ -12,52 +12,31 @@ import {
   checkForUpdate,
   describeChange,
   dutoHome,
-  formatBytes,
-  formatDuration,
-  formatTime,
+  fail,
   headerLabel,
   isCredentialLike,
   isValidHeaderValue,
   loadConfig,
-  localLabel,
+  mark,
   normalizeName,
+  ok,
+  paint,
   placeOf,
   reservedHeaderError,
+  runPlain,
   saveConfig,
-  statusColor,
   updateLine,
-  validateName
-} from "./chunk-DUC4RSBW.js";
-
-// src/ui/brand.ts
-function colorOn(stream = process.stdout) {
-  if (process.env.NO_COLOR) return false;
-  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
-  return Boolean(stream.isTTY);
-}
-var SGR = {
-  signal: "38;2;45;212;191",
-  muted: "38;2;138;143;139",
-  strong: "1",
-  ok: "38;2;74;222;128",
-  warn: "38;2;250;204;21",
-  err: "38;2;248;113;113"
-};
-function paint(tone, text2, stream) {
-  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text2}\x1B[0m` : text2;
-}
-var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
-var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
-var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
-var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+  validateName,
+  warn
+} from "./chunk-QFM4MUED.js";
 
 // src/index.ts
 import { hostname as hostname2 } from "os";
-import { join as join5, relative } from "path";
+import { join as join7, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.6.1";
+var CLI_VERSION = "1.8.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -360,9 +339,29 @@ async function resolveAllow(entries, o = {}) {
 }
 
 // src/session/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
 import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
+
+// src/session/envFiles.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { parse } from "dotenv";
+var ENV_FILES = [".env", ".env.local"];
+function readEnvFile(path) {
+  try {
+    return parse(readFileSync2(path, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+}
+function configEnv(dir, shell = process.env) {
+  const files = ENV_FILES.reduce((env, file) => ({ ...env, ...readEnvFile(join3(dir, file)) }), {});
+  return { ...files, ...shell };
+}
+
+// src/session/config.ts
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
     super(!file ? message2 : line ? `${file}, line ${line}: ${message2}` : `${file}: ${message2}`);
@@ -376,6 +375,7 @@ var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "trust_forwarded", "auth", "allow"];
+var SET_IT = `Add it to .env next to ${CONFIG_FILES[0]} or export it in the shell.`;
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -463,7 +463,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           if (headers.has(hName.toLowerCase())) throw fail3(`header ${hName} appears twice in "${raw}"`, hLine);
           const text3 = headerText(h.value);
           if (text3 === void 0) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
-          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}")`, hLine));
+          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}"). ${SET_IT}`, hLine));
           if (!isValidHeaderValue(value)) throw fail3(`invalid character in the value of ${hName} in "${raw}". Use ASCII or Latin-1 text.`, hLine);
           headers.set(hName.toLowerCase(), value);
         }
@@ -490,7 +490,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const text3 = isScalar(item) && typeof item.value === "string" ? item.value : null;
           if (text3 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
-          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine));
+          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}"). ${SET_IT}`, iLine));
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
             if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
@@ -525,13 +525,13 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
 function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
-    const present = CONFIG_FILES.filter((f) => existsSync2(join3(dir, f)));
+    const present = CONFIG_FILES.filter((f) => existsSync2(join4(dir, f)));
     if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" and ")} in the same folder. Delete one of them.`, void 0, "");
     if (present.length === 1) {
-      const path = join3(dir, present[0]);
-      return { path, tunnels: parseConfig(readFileSync2(path, "utf8"), present[0]) };
+      const path = join4(dir, present[0]);
+      return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0], configEnv(dir)) };
     }
-    if (existsSync2(join3(dir, ".git"))) return null;
+    if (existsSync2(join4(dir, ".git"))) return null;
     const up = dirname2(dir);
     if (up === dir) return null;
     dir = up;
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.6.1",
+    cliVersion: "1.8.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -2175,6 +2175,48 @@ async function isPortListening(port, timeoutMs = 500) {
 
 // src/session/auth.ts
 import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/session/attempts.ts
+var ATTEMPT_WINDOW_MS = 5 * 6e4;
+var MAX_FAILURES_PER_CLIENT = 10;
+var MAX_FAILURES_TOTAL = 100;
+var SWEEP_ABOVE_CLIENTS = 1e4;
+function msUntilBelow(times, max, now) {
+  if (times.length < max) return 0;
+  return Math.max(0, times[times.length - max] + ATTEMPT_WINDOW_MS - now);
+}
+var FailedAttempts = class {
+  constructor(now) {
+    this.now = now;
+  }
+  now;
+  byClient = /* @__PURE__ */ new Map();
+  total = [];
+  lockedFor(client) {
+    const now = this.now();
+    this.total = this.fresh(this.total, now);
+    const mine = this.fresh(this.byClient.get(client) ?? [], now);
+    if (mine.length) this.byClient.set(client, mine);
+    else this.byClient.delete(client);
+    return Math.max(msUntilBelow(mine, MAX_FAILURES_PER_CLIENT, now), msUntilBelow(this.total, MAX_FAILURES_TOTAL, now));
+  }
+  record(client) {
+    const now = this.now();
+    this.total = [...this.fresh(this.total, now), now].slice(-MAX_FAILURES_TOTAL);
+    this.byClient.set(client, [...this.fresh(this.byClient.get(client) ?? [], now), now].slice(-MAX_FAILURES_PER_CLIENT));
+    if (this.byClient.size > SWEEP_ABOVE_CLIENTS) this.sweep(now);
+  }
+  fresh(times, now) {
+    return times.filter((t) => t > now - ATTEMPT_WINDOW_MS);
+  }
+  sweep(now) {
+    for (const [client, times] of this.byClient) {
+      if (!this.fresh(times, now).length) this.byClient.delete(client);
+    }
+  }
+};
+
+// src/session/auth.ts
 var TUNNEL_COOKIE = "__Host-duto_tunnel";
 var SEC_FETCH_SITE_SAME_SITE = "same-site";
 var QR_TTL_MS = 5 * 6e4;
@@ -2189,6 +2231,7 @@ function parseBasic(value) {
   return m ? splitPair(Buffer.from(m[1], "base64").toString("utf8")) : null;
 }
 var first2 = (v) => Array.isArray(v) ? v[0] : v;
+var clientOf2 = (h) => first2(h["cf-connecting-ip"]) ?? "unknown";
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
   if (first2(h["sec-fetch-site"])?.toLowerCase() === SEC_FETCH_SITE_SAME_SITE) return false;
@@ -2203,20 +2246,28 @@ function sameHostOrigin(h) {
   return host !== "" && bareHost(host) === bareHost(h.host ?? "");
 }
 var TunnelAuth = class {
-  qrUser;
   tunnel;
   credentials;
   allow;
   now;
   secret;
   qr = null;
+  failures;
   constructor(o) {
     this.tunnel = o.tunnel;
     this.credentials = o.credentials;
     this.allow = o.allow;
     this.now = o.now ?? Date.now;
     this.secret = o.secret ?? randomBytes2(32);
-    this.qrUser = o.credentials[0]?.user ?? "";
+    this.failures = new FailedAttempts(this.now);
+  }
+  get qrUser() {
+    return this.credentials[0]?.user ?? "";
+  }
+  update(o) {
+    if (o.credentials[0]?.user !== this.qrUser) this.qr = null;
+    this.credentials = o.credentials;
+    this.allow = o.allow;
   }
   access(h) {
     if (this.allow) {
@@ -2228,9 +2279,19 @@ var TunnelAuth = class {
     if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
     const dutoAuthHeader = first2(h["x-duto-auth"]);
     const candidate = dutoAuthHeader !== void 0 ? splitPair(dutoAuthHeader) : parseBasic(first2(h.authorization));
-    if (candidate && this.checkPassword(candidate.user, candidate.password)) return { kind: "user", user: candidate.user };
+    if (candidate && this.attemptPassword(h, candidate.user, candidate.password) === "ok") return { kind: "user", user: candidate.user };
     return { kind: "denied" };
   }
+  lockedFor(h) {
+    return this.failures.lockedFor(clientOf2(h));
+  }
+  attemptPassword(h, user, password) {
+    const client = clientOf2(h);
+    if (this.failures.lockedFor(client) > 0) return "locked";
+    if (this.checkPassword(user, password)) return "ok";
+    this.failures.record(client);
+    return "wrong";
+  }
   checkPassword(user, password) {
     let ok2 = false;
     for (const c of this.credentials) {
@@ -2455,6 +2516,10 @@ function safeNext(raw) {
   if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
   return /^[\x21-\x7e]+$/.test(raw) ? raw : "/";
 }
+var ERROR_TEXT = {
+  wrong: "Wrong username or password.",
+  locked: "Too many wrong passwords. Wait a few minutes and try again."
+};
 function loginPage(o) {
   return pageShell(
     "Sign in \xB7 duto",
@@ -2468,7 +2533,7 @@ function loginPage(o) {
 <input id="username" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
 <label for="password">Password</label>
 <input id="password" name="password" type="password" autocomplete="current-password" required>
-${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
+${o.error ? `<p class="error" role="alert">${ERROR_TEXT[o.error]}</p>
 ` : ""}<button type="submit">Sign in</button>
 </form>
 <div class="retry">You stay signed in until you close the browser or the tunnel closes.</div>
@@ -2584,8 +2649,8 @@ function readForm(req, max) {
 }
 async function authRoute(req, res, route, auth) {
   const url = new URL(req.url ?? "/", "http://duto");
-  const page = (status, next, error) => {
-    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+  const page = (status, next, error, extra = {}) => {
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", ...extra });
     res.end(loginPage({ tunnel: route.tunnel, next, error }));
   };
   const go = (location, cookie) => {
@@ -2594,7 +2659,9 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeNext(url.searchParams.get("next")), false);
+    const next = safeNext(url.searchParams.get("next"));
+    if (auth.access(req.headers).kind !== "denied") go(next);
+    else page(200, next, null);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
@@ -2607,8 +2674,10 @@ async function authRoute(req, res, route, auth) {
     const form = new URLSearchParams(raw);
     const user = form.get("username") ?? "";
     const next = safeNext(form.get("next"));
-    if (auth.checkPassword(user, form.get("password") ?? "")) go(next, auth.loginCookie(user));
-    else page(401, next, true);
+    const attempt = auth.attemptPassword(req.headers, user, form.get("password") ?? "");
+    if (attempt === "ok") go(next, auth.loginCookie(user));
+    else if (attempt === "locked") page(429, next, "locked", { "retry-after": String(Math.ceil(auth.lockedFor(req.headers) / 1e3)) });
+    else page(401, next, "wrong");
     return true;
   }
   if (pathname === LOGOUT_PATH && req.method === "GET") {
@@ -2922,9 +2991,9 @@ async function startProxy(o) {
 
 // src/session/orphans.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
-var fileOf = (dir, cfPid) => join4(dir, `cloudflared-${cfPid}.json`);
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+var fileOf = (dir, cfPid) => join5(dir, `cloudflared-${cfPid}.json`);
 function recordCloudflared(dir, cfPid, sessionPid = process.pid) {
   try {
     mkdirSync3(dir, { recursive: true });
@@ -2946,7 +3015,7 @@ var realProc = {
   },
   isCloudflared(pid) {
     try {
-      if (process.platform === "linux") return readFileSync3(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
+      if (process.platform === "linux") return readFileSync4(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
       if (process.platform === "darwin") return spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" }).stdout.includes("cloudflared");
     } catch {
       return false;
@@ -2965,10 +3034,10 @@ function reapOrphans(dir, proc = realProc) {
   let killed = 0;
   for (const name of readdirSync(dir)) {
     if (!/^cloudflared-\d+\.json$/.test(name)) continue;
-    const path = join4(dir, name);
+    const path = join5(dir, name);
     let rec;
     try {
-      rec = JSON.parse(readFileSync3(path, "utf8"));
+      rec = JSON.parse(readFileSync4(path, "utf8"));
     } catch {
       rmSync2(path, { force: true });
       continue;
@@ -3052,6 +3121,10 @@ var Session = class {
   routes = /* @__PURE__ */ new Map();
   specs = /* @__PURE__ */ new Map();
   persistentAuths = /* @__PURE__ */ new Map();
+  allows = /* @__PURE__ */ new Map();
+  config = { error: null, warnings: [], reloads: 0 };
+  applying = Promise.resolve();
+  background = /* @__PURE__ */ new Set();
   proxy = null;
   child = null;
   token = null;
@@ -3063,7 +3136,7 @@ var Session = class {
   listeners = /* @__PURE__ */ new Set();
   snapshot = null;
   getState() {
-    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })) };
+    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })), config: { ...this.config } };
     return this.snapshot;
   }
   subscribe(fn) {
@@ -3075,12 +3148,17 @@ var Session = class {
     this.proxy = await startProxy({ routes: this.routes, store: this.records });
     this.tunnels = specs.map((s) => this.blank(s, false));
     this.emit();
+    const opening = this.openAll();
+    this.applying = opening.catch(() => void 0);
+    await opening;
+    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
+    this.timer = setInterval(() => void this.beat(), every);
+  }
+  async openAll() {
     const me = await this.o.api.me().catch(() => null);
     if (me) this.account = me.username ?? me.email;
     const existing = await this.o.api.endpoints().catch(() => []);
-    for (const t of this.tunnels) await this.open(t, existing);
-    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
-    this.timer = setInterval(() => void this.beat(), every);
+    await Promise.all([...this.tunnels].map((t) => this.open(t, existing)));
   }
   async add(spec) {
     if (this.tunnels.some((t2) => t2.key === keyOf(spec))) return;
@@ -3090,6 +3168,106 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
+  apply(specs) {
+    const run = this.applying.then(() => this.reconcile(specs));
+    this.applying = run.catch(() => void 0);
+    return run;
+  }
+  async settled() {
+    await this.applying;
+    while (this.background.size) await Promise.all([...this.background]);
+  }
+  inBackground(work) {
+    const run = work().catch(() => void 0);
+    this.background.add(run);
+    void run.finally(() => this.background.delete(run));
+  }
+  configFailed(error) {
+    this.config = { ...this.config, error };
+    this.emit();
+  }
+  async reconcile(specs) {
+    if (this.stopped) return;
+    const wanted = new Set(specs.map(keyOf));
+    for (const t of this.tunnels.filter((x) => !x.adHoc && !wanted.has(x.key))) this.remove(t);
+    const fresh = [];
+    for (const spec of specs) {
+      if (this.stopped) return;
+      const t = this.tunnels.find((x) => x.key === keyOf(spec));
+      if (t) {
+        await this.update(t, spec);
+        continue;
+      }
+      const added = this.blank(spec, false);
+      this.tunnels.push(added);
+      fresh.push(added);
+    }
+    if (fresh.length) this.inBackground(() => this.openFresh(fresh));
+    this.config = { error: null, warnings: credentialWarnings(specs), reloads: this.config.reloads + 1 };
+    this.emit();
+  }
+  async openFresh(tunnels) {
+    const existing = await this.o.api.endpoints().catch(() => []);
+    await Promise.all(tunnels.filter((t) => !this.gone(t)).map((t) => this.open(t, existing)));
+  }
+  remove(t) {
+    this.tunnels = this.tunnels.filter((x) => x !== t);
+    this.forget(t);
+    this.emit();
+    const endpointId = t.endpointId;
+    if (endpointId) this.inBackground(async () => void await withTimeout(this.o.api.closeTunnel(endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS));
+  }
+  forget(t) {
+    if (t.hostname) this.routes.delete(t.hostname.toLowerCase());
+    this.specs.delete(t.key);
+    this.persistentAuths.delete(t.key);
+    this.allows.delete(t.key);
+  }
+  async update(t, spec) {
+    const before = JSON.stringify(this.specs.get(t.key));
+    const changed = before !== JSON.stringify(spec);
+    const portChanged = t.port !== spec.port;
+    this.specs.set(t.key, spec);
+    const runtime = { url: t.url, hostname: t.hostname, endpointId: t.endpointId, status: t.status, error: t.error, requests: t.requests, errors: t.errors };
+    for (const k of Object.keys(t)) delete t[k];
+    Object.assign(t, this.describe(spec), { adHoc: false }, runtime);
+    const auth = await this.refreshAuth(t.key);
+    if (t.status === "failed") {
+      if (changed) this.inBackground(() => this.open(t, null));
+      return;
+    }
+    if (t.hostname) this.routes.set(t.hostname.toLowerCase(), this.routeOf(t, auth));
+    this.emit();
+    if (portChanged && t.endpointId) this.inBackground(() => this.open(t, null));
+  }
+  routeOf(t, auth) {
+    return { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth };
+  }
+  async allowFor(key, spec) {
+    if (!spec.allow?.length) {
+      this.allows.delete(key);
+      return void 0;
+    }
+    const entries = JSON.stringify(spec.allow);
+    const cached = this.allows.get(key);
+    if (cached?.entries === entries) return cached.list;
+    const list = await (this.o.resolveAllow ?? resolveAllow)(spec.allow);
+    this.allows.set(key, { entries, list });
+    return list;
+  }
+  async refreshAuth(key) {
+    const spec = this.specs.get(key);
+    const existing = this.persistentAuths.get(key);
+    if (!spec?.auth?.length) {
+      this.persistentAuths.delete(key);
+      this.allows.delete(key);
+      return void 0;
+    }
+    const allow = await this.allowFor(key, spec);
+    if (!existing) return this.authFor(key);
+    existing.update({ credentials: spec.auth, allow });
+    return existing;
+  }
   qrLink(key) {
     const t = this.tunnels.find((x) => x.key === key);
     if (!t?.url) return null;
@@ -3106,7 +3284,7 @@ var Session = class {
     if (existing) return existing;
     const spec = this.specs.get(key);
     if (!spec?.auth?.length) return void 0;
-    const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
+    const allow = await this.allowFor(key, spec);
     const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
     this.persistentAuths.set(key, auth);
     return auth;
@@ -3127,7 +3305,13 @@ var Session = class {
   }
   blank(spec, adHoc) {
     this.specs.set(keyOf(spec), spec);
-    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+    return { ...this.describe(spec), url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+  }
+  describe(spec) {
+    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {} };
+  }
+  gone(t) {
+    return this.stopped || !this.tunnels.includes(t);
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
@@ -3143,12 +3327,12 @@ var Session = class {
         ...t.name ? { name: t.name } : {},
         proxyPort: this.proxy.port
       });
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
       const auth = await this.authFor(t.key);
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
@@ -3156,7 +3340,7 @@ var Session = class {
       t.hostname = res.hostname;
       t.endpointId = res.endpointId;
       t.error = null;
-      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth });
+      this.routes.set(res.hostname.toLowerCase(), this.routeOf(t, auth));
       t.status = await isPortListening(t.port) ? "live" : "no-listener";
       this.ensureCloudflared(res.tunnelToken);
       this.emit();
@@ -3273,39 +3457,60 @@ var Session = class {
   }
 };
 
-// src/ui/plain.ts
-function runPlain(session, out) {
-  const announced = /* @__PURE__ */ new Set();
-  const failed = /* @__PURE__ */ new Set();
-  const printed = /* @__PURE__ */ new Set();
-  const onState = () => {
-    for (const t of session.getState().tunnels) {
-      if ((t.status === "live" || t.status === "no-listener") && t.url && !announced.has(t.key)) {
-        announced.add(t.key);
-        out(`${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`);
-      }
-      if (t.status === "failed" && t.error && !failed.has(t.key)) {
-        failed.add(t.key);
-        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
-      }
+// src/session/watch.ts
+import { readFileSync as readFileSync5, watch } from "fs";
+import { basename, dirname as dirname3, join as join6 } from "path";
+var RELOAD_DEBOUNCE_MS = 150;
+function readText(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function watchConfig(o) {
+  const file = basename(o.path);
+  const dir = dirname3(o.path);
+  const watched = /* @__PURE__ */ new Set([file, ...ENV_FILES]);
+  const snapshot = () => [readText(o.path), ...ENV_FILES.map((f) => readText(join6(dir, f)))].join("\0");
+  let lastSeen = snapshot();
+  let timer = null;
+  const reload = () => {
+    timer = null;
+    let text2;
+    let seen;
+    try {
+      text2 = readText(o.path);
+      seen = snapshot();
+    } catch (err) {
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
-  };
-  const onRecords = () => {
-    for (const r of [...session.records.list()].reverse()) {
-      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
-      printed.add(r.id);
-      const method = r.websocket ? "WS" : r.method;
-      out(
-        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
-      );
+    if (seen === lastSeen) return;
+    lastSeen = seen;
+    if (text2 === null) return o.onError(`${file} was deleted.`);
+    let specs;
+    try {
+      specs = parseConfig(text2, file, configEnv(dir));
+    } catch (err) {
+      if (err instanceof ConfigError) return o.onError(err.message);
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    o.onChange(specs);
   };
-  const offState = session.subscribe(onState);
-  const offRecords = session.records.subscribe(onRecords);
-  onState();
-  return () => {
-    offState();
-    offRecords();
+  const schedule = () => {
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(reload, o.debounceMs ?? RELOAD_DEBOUNCE_MS);
+  };
+  const watcher = watch(dir, (_event, name) => {
+    if (name === null || watched.has(name)) schedule();
+  });
+  watcher.on("error", () => void 0);
+  return {
+    close() {
+      if (timer) clearTimeout(timer);
+      watcher.close();
+    }
   };
 }
 
@@ -3355,7 +3560,7 @@ function wantsUi(flags) {
   if (process.platform === "win32") return process.argv.includes("--ui");
   return true;
 }
-async function runSession(specs, source, flags) {
+async function runSession(specs, source, flags, configPath) {
   const config = loadConfig();
   if (!config.authtoken) fail2(LOGIN_HINT);
   const api = createApiClient({ baseUrl: apiUrl(), token: config.authtoken });
@@ -3366,7 +3571,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join5(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join7(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -3377,9 +3582,11 @@ async function runSession(specs, source, flags) {
     }
   }
   const warnings = credentialWarnings(specs);
+  const watcher = configPath ? watchConfig({ path: configPath, onChange: (next) => void session.apply(next).catch((err) => session.configFailed(err instanceof Error ? err.message : String(err))), onError: (error) => session.configFailed(error) }) : null;
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-MSVJF43W.js");
+    const { runFullscreen } = await import("./fullscreen-Q3RGW6NJ.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
+    watcher?.close();
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
@@ -3402,6 +3609,7 @@ async function runSession(specs, source, flags) {
   });
   await Promise.race([session.start(specs), stopped]);
   await stopped;
+  watcher?.close();
   stopLog();
   await session.stop();
   await inspector?.close().catch(() => void 0);
@@ -3429,7 +3637,7 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
 `);
       process.exit(0);
     }
-    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags);
+    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags, found.path);
   }
   const port = parsePort(rawPort);
   const name = parseName(flags.name) ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.6.1",
+  "version": "1.8.0",
   "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
   "license": "MIT",
   "type": "module",
@@ -29,6 +29,7 @@
   },
   "dependencies": {
     "cac": "^6.7.14",
+    "dotenv": "17.4.2",
     "ink": "^5.2.1",
     "qrcode-generator": "^1.5.2",
     "react": "^18.3.1",