@dutodev/cli 1.7.0 → 1.8.0

package/README.md

@@ -34,7 +34,7 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
    duto 3000 --name web       # https://web-<user>.duto.dev
    ```
 
-Every name you use with `--name` is reserved for you and keeps the same URL. Names take lowercase letters and numbers only, no hyphens.
+Every name you use with `--name` keeps the same URL, and only you can use it. Names take lowercase letters and numbers only, no hyphens. The account limit counts named tunnels online at once: closed ones do not count, and names unused for 30 days are released.
 
 ## Several tunnels: `duto.yml`
 
@@ -49,6 +49,8 @@ tunnels:
 
 All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.dev`) from the same file.
 
+**Edit while it runs.** Save `duto.yml` and the change applies right away, without restarting: new tunnels open, removed ones close, and a new `port`, `host`, `headers`, `auth` or `allow` counts from the next request, on the same URL. Visitors signed in with a password stay signed in while their user is still in `auth`. A save with a mistake changes nothing: the tunnels keep the last valid config and the screen shows the error with its line until you save a fixed file. Tunnels opened with `n` on the screen are left alone. Saving `.env` or `.env.local` applies the file again with the new values.
+
 ### Host and headers
 
 By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.dev`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
@@ -140,7 +142,7 @@ tunnels:
 ```
 
 - `auth` is a list of `user:password`. Use one pair per person. The first `:` separates the user from the password; the password is 8 to 128 characters.
-- `${VAR}` reads an environment variable. Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
+- `${VAR}` reads an environment variable, or the `.env` and `.env.local` next to `duto.yml` (`.env.local` wins over `.env`; a variable exported in the shell wins over both). Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
 - In a one-line list in brackets, `${VAR}` needs quotes (`auth: ["client:${CLIENT_PASSWORD}"]`), because `{` is special in YAML. In a block list, as above, it does not.
 - On the command line, for a single tunnel: `duto 3000 --auth client:my-password1 --allow stripe`. Both options can be repeated. They only work with a port; with a `duto.yml`, put them in the file.
 - Careful: a password passed to `--auth` ends up in your shell history and is visible to anyone who runs `ps` on the machine. For anything beyond a quick test, use `duto.yml` with `${VAR}`.

package/dist/{chunk-QVJHHURM.js → chunk-QFM4MUED.js}

@@ -1,5 +1,27 @@
 #!/usr/bin/env node
 
+// src/ui/brand.ts
+function colorOn(stream = process.stdout) {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
+  return Boolean(stream.isTTY);
+}
+var SGR = {
+  signal: "38;2;45;212;191",
+  muted: "38;2;138;143;139",
+  strong: "1",
+  ok: "38;2;74;222;128",
+  warn: "38;2;250;204;21",
+  err: "38;2;248;113;113"
+};
+function paint(tone, text, stream) {
+  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text}\x1B[0m` : text;
+}
+var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
+var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
+var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
+var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+
 // ../shared/src/names.ts
 var EMAIL_SENDING_SUBDOMAINS = ["send"];
 var RESERVED_NAMES = [
@@ -477,6 +499,95 @@ function loadConfig() {
   return fresh;
 }
 
+// src/ui/format.ts
+function statusColor(status) {
+  if (status === null) return "muted";
+  if (status === 101) return "signal";
+  if (status >= 500) return "err";
+  if (status >= 400) return "warn";
+  if (status >= 300) return "muted";
+  return "ok";
+}
+function formatDuration(ms) {
+  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatTime(ms) {
+  const d = new Date(ms);
+  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
+}
+function localLabel(t) {
+  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
+}
+
+// src/ui/plain.ts
+var KEEPING_LAST_CONFIG = "Tunnels keep the last valid config.";
+function runPlain(session, out) {
+  const announced = /* @__PURE__ */ new Map();
+  const failed = /* @__PURE__ */ new Set();
+  const printed = /* @__PURE__ */ new Set();
+  let configError = null;
+  let reloads = 0;
+  const onTunnels = (state) => {
+    const keys = new Set(state.tunnels.map((t) => t.key));
+    for (const key of [...announced.keys()]) {
+      if (keys.has(key)) continue;
+      announced.delete(key);
+      out(`${paint("muted", "\u25CB")} ${key}  closed`);
+    }
+    for (const key of [...failed]) if (!keys.has(key)) failed.delete(key);
+    for (const t of state.tunnels) {
+      if ((t.status === "live" || t.status === "no-listener") && t.url) {
+        const line = `${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`;
+        if (announced.get(t.key) !== line) {
+          announced.set(t.key, line);
+          out(line);
+        }
+      }
+      if (t.status !== "failed") failed.delete(t.key);
+      if (t.status === "failed" && t.error && !failed.has(t.key)) {
+        failed.add(t.key);
+        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
+      }
+    }
+  };
+  const onConfig = (state) => {
+    const { error, warnings } = state.config;
+    if (error && error !== configError) out(`${paint("err", "\u2716")} ${error} ${KEEPING_LAST_CONFIG}`);
+    configError = error;
+    if (state.config.reloads === reloads) return;
+    reloads = state.config.reloads;
+    out(`${paint("signal", "\u21BB")} ${state.source} reloaded`);
+    for (const w of warnings) out(paint("warn", w));
+  };
+  const onState = () => {
+    const state = session.getState();
+    onTunnels(state);
+    onConfig(state);
+  };
+  const onRecords = () => {
+    for (const r of [...session.records.list()].reverse()) {
+      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
+      printed.add(r.id);
+      const method = r.websocket ? "WS" : r.method;
+      out(
+        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
+      );
+    }
+  };
+  const offState = session.subscribe(onState);
+  const offRecords = session.records.subscribe(onRecords);
+  onState();
+  return () => {
+    offState();
+    offRecords();
+  };
+}
+
 // src/updates.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2 } from "path";
@@ -575,32 +686,12 @@ function bodyNote(r, side) {
   return null;
 }
 
-// src/ui/format.ts
-function statusColor(status) {
-  if (status === null) return "muted";
-  if (status === 101) return "signal";
-  if (status >= 500) return "err";
-  if (status >= 400) return "warn";
-  if (status >= 300) return "muted";
-  return "ok";
-}
-function formatDuration(ms) {
-  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatBytes(n) {
-  if (n < 1024) return `${n} B`;
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-  return `${(n / 1024 / 1024).toFixed(1)} MB`;
-}
-function formatTime(ms) {
-  const d = new Date(ms);
-  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-}
-function localLabel(t) {
-  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
-}
-
 export {
+  paint,
+  mark,
+  ok,
+  fail,
+  warn,
   MAX_NAME,
   normalizeName,
   validateName,
@@ -628,6 +719,8 @@ export {
   formatBytes,
   formatTime,
   localLabel,
+  KEEPING_LAST_CONFIG,
+  runPlain,
   checkForUpdate,
   updateLine
 };

package/dist/{fullscreen-ZNFUDV2B.js → fullscreen-Q3RGW6NJ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  KEEPING_LAST_CONFIG,
   MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
@@ -15,7 +16,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-QVJHHURM.js";
+} from "./chunk-QFM4MUED.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -348,6 +349,12 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
     const t = setTimeout(() => setMessage(null), 4e3);
     return () => clearTimeout(t);
   }, [message]);
+  const reloads = state.config.reloads;
+  const reloadWarnings = state.config.warnings;
+  useEffect(() => {
+    if (reloads === 0) return;
+    setMessage({ text: [`\u21BB ${state.source} reloaded`, ...reloadWarnings].join("  "), tone: reloadWarnings.length ? "warn" : "signal" });
+  }, [reloads]);
   const inQr = mode.kind === "qr";
   useEffect(() => {
     if (!inQr) return;
@@ -467,7 +474,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
   });
   const live = state.tunnels.filter((t) => t.status === "live").length;
   const conn = state.connection === "online" ? { text: "connected \u25CF", color: C.signal } : state.connection === "connecting" ? { text: "connecting\u2026", color: C.muted } : { text: "reconnecting\u2026", color: C.warn };
-  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0));
+  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0) - (state.config.error ? 1 : 0));
   const detailRecord = mode.kind === "detail" ? all.find((r) => r.id === mode.id) : void 0;
   const qrTunnel = mode.kind === "qr" ? state.tunnels.find((t) => t.key === mode.key) : void 0;
   return /* @__PURE__ */ jsxs6(Box5, { flexDirection: "column", width, children: [
@@ -493,6 +500,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
       /* @__PURE__ */ jsx6(Text6, { color: conn.color, children: conn.text })
     ] }),
     update && /* @__PURE__ */ jsx6(Text6, { color: C.warn, children: updateLine(update) }),
+    state.config.error && /* @__PURE__ */ jsx6(Text6, { color: C.err, children: `${state.config.error} ${KEEPING_LAST_CONFIG}` }),
     /* @__PURE__ */ jsx6(Text6, { children: " " }),
     /* @__PURE__ */ jsx6(TunnelTable, { tunnels: state.tunnels, selected: selTun, focused: focus === "tunnels" }),
     inspector && /* @__PURE__ */ jsx6(Text6, { color: C.muted, children: `inspector  ${inspector.url}` }),

package/dist/index.js

@@ -12,52 +12,31 @@ import {
   checkForUpdate,
   describeChange,
   dutoHome,
-  formatBytes,
-  formatDuration,
-  formatTime,
+  fail,
   headerLabel,
   isCredentialLike,
   isValidHeaderValue,
   loadConfig,
-  localLabel,
+  mark,
   normalizeName,
+  ok,
+  paint,
   placeOf,
   reservedHeaderError,
+  runPlain,
   saveConfig,
-  statusColor,
   updateLine,
-  validateName
-} from "./chunk-QVJHHURM.js";
-
-// src/ui/brand.ts
-function colorOn(stream = process.stdout) {
-  if (process.env.NO_COLOR) return false;
-  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
-  return Boolean(stream.isTTY);
-}
-var SGR = {
-  signal: "38;2;45;212;191",
-  muted: "38;2;138;143;139",
-  strong: "1",
-  ok: "38;2;74;222;128",
-  warn: "38;2;250;204;21",
-  err: "38;2;248;113;113"
-};
-function paint(tone, text2, stream) {
-  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text2}\x1B[0m` : text2;
-}
-var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
-var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
-var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
-var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+  validateName,
+  warn
+} from "./chunk-QFM4MUED.js";
 
 // src/index.ts
 import { hostname as hostname2 } from "os";
-import { join as join5, relative } from "path";
+import { join as join7, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.7.0";
+var CLI_VERSION = "1.8.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -360,9 +339,29 @@ async function resolveAllow(entries, o = {}) {
 }
 
 // src/session/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
 import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
+
+// src/session/envFiles.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { parse } from "dotenv";
+var ENV_FILES = [".env", ".env.local"];
+function readEnvFile(path) {
+  try {
+    return parse(readFileSync2(path, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+}
+function configEnv(dir, shell = process.env) {
+  const files = ENV_FILES.reduce((env, file) => ({ ...env, ...readEnvFile(join3(dir, file)) }), {});
+  return { ...files, ...shell };
+}
+
+// src/session/config.ts
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
     super(!file ? message2 : line ? `${file}, line ${line}: ${message2}` : `${file}: ${message2}`);
@@ -376,6 +375,7 @@ var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "trust_forwarded", "auth", "allow"];
+var SET_IT = `Add it to .env next to ${CONFIG_FILES[0]} or export it in the shell.`;
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -463,7 +463,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           if (headers.has(hName.toLowerCase())) throw fail3(`header ${hName} appears twice in "${raw}"`, hLine);
           const text3 = headerText(h.value);
           if (text3 === void 0) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
-          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}")`, hLine));
+          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}"). ${SET_IT}`, hLine));
           if (!isValidHeaderValue(value)) throw fail3(`invalid character in the value of ${hName} in "${raw}". Use ASCII or Latin-1 text.`, hLine);
           headers.set(hName.toLowerCase(), value);
         }
@@ -490,7 +490,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const text3 = isScalar(item) && typeof item.value === "string" ? item.value : null;
           if (text3 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
-          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine));
+          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}"). ${SET_IT}`, iLine));
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
             if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
@@ -525,13 +525,13 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
 function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
-    const present = CONFIG_FILES.filter((f) => existsSync2(join3(dir, f)));
+    const present = CONFIG_FILES.filter((f) => existsSync2(join4(dir, f)));
     if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" and ")} in the same folder. Delete one of them.`, void 0, "");
     if (present.length === 1) {
-      const path = join3(dir, present[0]);
-      return { path, tunnels: parseConfig(readFileSync2(path, "utf8"), present[0]) };
+      const path = join4(dir, present[0]);
+      return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0], configEnv(dir)) };
     }
-    if (existsSync2(join3(dir, ".git"))) return null;
+    if (existsSync2(join4(dir, ".git"))) return null;
     const up = dirname2(dir);
     if (up === dir) return null;
     dir = up;
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.7.0",
+    cliVersion: "1.8.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -2246,7 +2246,6 @@ function sameHostOrigin(h) {
   return host !== "" && bareHost(host) === bareHost(h.host ?? "");
 }
 var TunnelAuth = class {
-  qrUser;
   tunnel;
   credentials;
   allow;
@@ -2260,9 +2259,16 @@ var TunnelAuth = class {
     this.allow = o.allow;
     this.now = o.now ?? Date.now;
     this.secret = o.secret ?? randomBytes2(32);
-    this.qrUser = o.credentials[0]?.user ?? "";
     this.failures = new FailedAttempts(this.now);
   }
+  get qrUser() {
+    return this.credentials[0]?.user ?? "";
+  }
+  update(o) {
+    if (o.credentials[0]?.user !== this.qrUser) this.qr = null;
+    this.credentials = o.credentials;
+    this.allow = o.allow;
+  }
   access(h) {
     if (this.allow) {
       const ip = first2(h["cf-connecting-ip"]);
@@ -2653,7 +2659,9 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeNext(url.searchParams.get("next")), null);
+    const next = safeNext(url.searchParams.get("next"));
+    if (auth.access(req.headers).kind !== "denied") go(next);
+    else page(200, next, null);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
@@ -2983,9 +2991,9 @@ async function startProxy(o) {
 
 // src/session/orphans.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
-var fileOf = (dir, cfPid) => join4(dir, `cloudflared-${cfPid}.json`);
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+var fileOf = (dir, cfPid) => join5(dir, `cloudflared-${cfPid}.json`);
 function recordCloudflared(dir, cfPid, sessionPid = process.pid) {
   try {
     mkdirSync3(dir, { recursive: true });
@@ -3007,7 +3015,7 @@ var realProc = {
   },
   isCloudflared(pid) {
     try {
-      if (process.platform === "linux") return readFileSync3(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
+      if (process.platform === "linux") return readFileSync4(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
       if (process.platform === "darwin") return spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" }).stdout.includes("cloudflared");
     } catch {
       return false;
@@ -3026,10 +3034,10 @@ function reapOrphans(dir, proc = realProc) {
   let killed = 0;
   for (const name of readdirSync(dir)) {
     if (!/^cloudflared-\d+\.json$/.test(name)) continue;
-    const path = join4(dir, name);
+    const path = join5(dir, name);
     let rec;
     try {
-      rec = JSON.parse(readFileSync3(path, "utf8"));
+      rec = JSON.parse(readFileSync4(path, "utf8"));
     } catch {
       rmSync2(path, { force: true });
       continue;
@@ -3113,6 +3121,10 @@ var Session = class {
   routes = /* @__PURE__ */ new Map();
   specs = /* @__PURE__ */ new Map();
   persistentAuths = /* @__PURE__ */ new Map();
+  allows = /* @__PURE__ */ new Map();
+  config = { error: null, warnings: [], reloads: 0 };
+  applying = Promise.resolve();
+  background = /* @__PURE__ */ new Set();
   proxy = null;
   child = null;
   token = null;
@@ -3124,7 +3136,7 @@ var Session = class {
   listeners = /* @__PURE__ */ new Set();
   snapshot = null;
   getState() {
-    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })) };
+    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })), config: { ...this.config } };
     return this.snapshot;
   }
   subscribe(fn) {
@@ -3136,12 +3148,17 @@ var Session = class {
     this.proxy = await startProxy({ routes: this.routes, store: this.records });
     this.tunnels = specs.map((s) => this.blank(s, false));
     this.emit();
+    const opening = this.openAll();
+    this.applying = opening.catch(() => void 0);
+    await opening;
+    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
+    this.timer = setInterval(() => void this.beat(), every);
+  }
+  async openAll() {
     const me = await this.o.api.me().catch(() => null);
     if (me) this.account = me.username ?? me.email;
     const existing = await this.o.api.endpoints().catch(() => []);
-    for (const t of this.tunnels) await this.open(t, existing);
-    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
-    this.timer = setInterval(() => void this.beat(), every);
+    await Promise.all([...this.tunnels].map((t) => this.open(t, existing)));
   }
   async add(spec) {
     if (this.tunnels.some((t2) => t2.key === keyOf(spec))) return;
@@ -3151,6 +3168,106 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
+  apply(specs) {
+    const run = this.applying.then(() => this.reconcile(specs));
+    this.applying = run.catch(() => void 0);
+    return run;
+  }
+  async settled() {
+    await this.applying;
+    while (this.background.size) await Promise.all([...this.background]);
+  }
+  inBackground(work) {
+    const run = work().catch(() => void 0);
+    this.background.add(run);
+    void run.finally(() => this.background.delete(run));
+  }
+  configFailed(error) {
+    this.config = { ...this.config, error };
+    this.emit();
+  }
+  async reconcile(specs) {
+    if (this.stopped) return;
+    const wanted = new Set(specs.map(keyOf));
+    for (const t of this.tunnels.filter((x) => !x.adHoc && !wanted.has(x.key))) this.remove(t);
+    const fresh = [];
+    for (const spec of specs) {
+      if (this.stopped) return;
+      const t = this.tunnels.find((x) => x.key === keyOf(spec));
+      if (t) {
+        await this.update(t, spec);
+        continue;
+      }
+      const added = this.blank(spec, false);
+      this.tunnels.push(added);
+      fresh.push(added);
+    }
+    if (fresh.length) this.inBackground(() => this.openFresh(fresh));
+    this.config = { error: null, warnings: credentialWarnings(specs), reloads: this.config.reloads + 1 };
+    this.emit();
+  }
+  async openFresh(tunnels) {
+    const existing = await this.o.api.endpoints().catch(() => []);
+    await Promise.all(tunnels.filter((t) => !this.gone(t)).map((t) => this.open(t, existing)));
+  }
+  remove(t) {
+    this.tunnels = this.tunnels.filter((x) => x !== t);
+    this.forget(t);
+    this.emit();
+    const endpointId = t.endpointId;
+    if (endpointId) this.inBackground(async () => void await withTimeout(this.o.api.closeTunnel(endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS));
+  }
+  forget(t) {
+    if (t.hostname) this.routes.delete(t.hostname.toLowerCase());
+    this.specs.delete(t.key);
+    this.persistentAuths.delete(t.key);
+    this.allows.delete(t.key);
+  }
+  async update(t, spec) {
+    const before = JSON.stringify(this.specs.get(t.key));
+    const changed = before !== JSON.stringify(spec);
+    const portChanged = t.port !== spec.port;
+    this.specs.set(t.key, spec);
+    const runtime = { url: t.url, hostname: t.hostname, endpointId: t.endpointId, status: t.status, error: t.error, requests: t.requests, errors: t.errors };
+    for (const k of Object.keys(t)) delete t[k];
+    Object.assign(t, this.describe(spec), { adHoc: false }, runtime);
+    const auth = await this.refreshAuth(t.key);
+    if (t.status === "failed") {
+      if (changed) this.inBackground(() => this.open(t, null));
+      return;
+    }
+    if (t.hostname) this.routes.set(t.hostname.toLowerCase(), this.routeOf(t, auth));
+    this.emit();
+    if (portChanged && t.endpointId) this.inBackground(() => this.open(t, null));
+  }
+  routeOf(t, auth) {
+    return { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth };
+  }
+  async allowFor(key, spec) {
+    if (!spec.allow?.length) {
+      this.allows.delete(key);
+      return void 0;
+    }
+    const entries = JSON.stringify(spec.allow);
+    const cached = this.allows.get(key);
+    if (cached?.entries === entries) return cached.list;
+    const list = await (this.o.resolveAllow ?? resolveAllow)(spec.allow);
+    this.allows.set(key, { entries, list });
+    return list;
+  }
+  async refreshAuth(key) {
+    const spec = this.specs.get(key);
+    const existing = this.persistentAuths.get(key);
+    if (!spec?.auth?.length) {
+      this.persistentAuths.delete(key);
+      this.allows.delete(key);
+      return void 0;
+    }
+    const allow = await this.allowFor(key, spec);
+    if (!existing) return this.authFor(key);
+    existing.update({ credentials: spec.auth, allow });
+    return existing;
+  }
   qrLink(key) {
     const t = this.tunnels.find((x) => x.key === key);
     if (!t?.url) return null;
@@ -3167,7 +3284,7 @@ var Session = class {
     if (existing) return existing;
     const spec = this.specs.get(key);
     if (!spec?.auth?.length) return void 0;
-    const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
+    const allow = await this.allowFor(key, spec);
     const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
     this.persistentAuths.set(key, auth);
     return auth;
@@ -3188,7 +3305,13 @@ var Session = class {
   }
   blank(spec, adHoc) {
     this.specs.set(keyOf(spec), spec);
-    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+    return { ...this.describe(spec), url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+  }
+  describe(spec) {
+    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {} };
+  }
+  gone(t) {
+    return this.stopped || !this.tunnels.includes(t);
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
@@ -3204,12 +3327,12 @@ var Session = class {
         ...t.name ? { name: t.name } : {},
         proxyPort: this.proxy.port
       });
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
       const auth = await this.authFor(t.key);
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
@@ -3217,7 +3340,7 @@ var Session = class {
       t.hostname = res.hostname;
       t.endpointId = res.endpointId;
       t.error = null;
-      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth });
+      this.routes.set(res.hostname.toLowerCase(), this.routeOf(t, auth));
       t.status = await isPortListening(t.port) ? "live" : "no-listener";
       this.ensureCloudflared(res.tunnelToken);
       this.emit();
@@ -3334,39 +3457,60 @@ var Session = class {
   }
 };
 
-// src/ui/plain.ts
-function runPlain(session, out) {
-  const announced = /* @__PURE__ */ new Set();
-  const failed = /* @__PURE__ */ new Set();
-  const printed = /* @__PURE__ */ new Set();
-  const onState = () => {
-    for (const t of session.getState().tunnels) {
-      if ((t.status === "live" || t.status === "no-listener") && t.url && !announced.has(t.key)) {
-        announced.add(t.key);
-        out(`${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`);
-      }
-      if (t.status === "failed" && t.error && !failed.has(t.key)) {
-        failed.add(t.key);
-        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
-      }
+// src/session/watch.ts
+import { readFileSync as readFileSync5, watch } from "fs";
+import { basename, dirname as dirname3, join as join6 } from "path";
+var RELOAD_DEBOUNCE_MS = 150;
+function readText(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function watchConfig(o) {
+  const file = basename(o.path);
+  const dir = dirname3(o.path);
+  const watched = /* @__PURE__ */ new Set([file, ...ENV_FILES]);
+  const snapshot = () => [readText(o.path), ...ENV_FILES.map((f) => readText(join6(dir, f)))].join("\0");
+  let lastSeen = snapshot();
+  let timer = null;
+  const reload = () => {
+    timer = null;
+    let text2;
+    let seen;
+    try {
+      text2 = readText(o.path);
+      seen = snapshot();
+    } catch (err) {
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
-  };
-  const onRecords = () => {
-    for (const r of [...session.records.list()].reverse()) {
-      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
-      printed.add(r.id);
-      const method = r.websocket ? "WS" : r.method;
-      out(
-        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
-      );
+    if (seen === lastSeen) return;
+    lastSeen = seen;
+    if (text2 === null) return o.onError(`${file} was deleted.`);
+    let specs;
+    try {
+      specs = parseConfig(text2, file, configEnv(dir));
+    } catch (err) {
+      if (err instanceof ConfigError) return o.onError(err.message);
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    o.onChange(specs);
   };
-  const offState = session.subscribe(onState);
-  const offRecords = session.records.subscribe(onRecords);
-  onState();
-  return () => {
-    offState();
-    offRecords();
+  const schedule = () => {
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(reload, o.debounceMs ?? RELOAD_DEBOUNCE_MS);
+  };
+  const watcher = watch(dir, (_event, name) => {
+    if (name === null || watched.has(name)) schedule();
+  });
+  watcher.on("error", () => void 0);
+  return {
+    close() {
+      if (timer) clearTimeout(timer);
+      watcher.close();
+    }
   };
 }
 
@@ -3416,7 +3560,7 @@ function wantsUi(flags) {
   if (process.platform === "win32") return process.argv.includes("--ui");
   return true;
 }
-async function runSession(specs, source, flags) {
+async function runSession(specs, source, flags, configPath) {
   const config = loadConfig();
   if (!config.authtoken) fail2(LOGIN_HINT);
   const api = createApiClient({ baseUrl: apiUrl(), token: config.authtoken });
@@ -3427,7 +3571,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join5(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join7(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -3438,9 +3582,11 @@ async function runSession(specs, source, flags) {
     }
   }
   const warnings = credentialWarnings(specs);
+  const watcher = configPath ? watchConfig({ path: configPath, onChange: (next) => void session.apply(next).catch((err) => session.configFailed(err instanceof Error ? err.message : String(err))), onError: (error) => session.configFailed(error) }) : null;
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-ZNFUDV2B.js");
+    const { runFullscreen } = await import("./fullscreen-Q3RGW6NJ.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
+    watcher?.close();
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
@@ -3463,6 +3609,7 @@ async function runSession(specs, source, flags) {
   });
   await Promise.race([session.start(specs), stopped]);
   await stopped;
+  watcher?.close();
   stopLog();
   await session.stop();
   await inspector?.close().catch(() => void 0);
@@ -3490,7 +3637,7 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
 `);
       process.exit(0);
     }
-    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags);
+    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags, found.path);
   }
   const port = parsePort(rawPort);
   const name = parseName(flags.name) ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
   "license": "MIT",
   "type": "module",
@@ -29,6 +29,7 @@
   },
   "dependencies": {
     "cac": "^6.7.14",
+    "dotenv": "17.4.2",
     "ink": "^5.2.1",
     "qrcode-generator": "^1.5.2",
     "react": "^18.3.1",