@dutodev/cli 1.8.0 → 1.9.0

package/README.md

@@ -3,7 +3,7 @@
 Put a local service on the internet at a stable HTTPS URL, with one command:
 
 ```
-duto 3000 --name web     # https://web-<user>.duto.dev → localhost:3000
+duto 3000 --name web     # https://web-<user>.duto.page → localhost:3000
 ```
 
 The URL stays the same from one session to the next. That makes it good for webhooks, login callbacks, testing on your phone, or showing someone your work without deploying.
@@ -20,8 +20,13 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
 
 ## Get started
 
-1. At [duto.dev](https://duto.dev), open **Authtoken** and generate your token.
-2. Connect the CLI to your account (once per machine):
+1. Connect the CLI to your account (once per machine). It opens your browser so you can approve it:
+
+   ```
+   duto login
+   ```
+
+2. On CI and servers with no browser, create a token on the **Machines** page at [duto.dev](https://duto.dev) and pass it:
 
    ```
    duto login <token>
@@ -30,8 +35,8 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
 3. Open a tunnel:
 
    ```
-   duto 3000                  # https://<user>.duto.dev
-   duto 3000 --name web       # https://web-<user>.duto.dev
+   duto 3000                  # https://<user>.duto.page
+   duto 3000 --name web       # https://web-<user>.duto.page
    ```
 
 Every name you use with `--name` keeps the same URL, and only you can use it. Names take lowercase letters and numbers only, no hyphens. The account limit counts named tunnels online at once: closed ones do not count, and names unused for 30 days are released.
@@ -47,13 +52,13 @@ tunnels:
   webhook: 4000
 ```
 
-All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.dev`) from the same file.
+All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.page`) from the same file.
 
 **Edit while it runs.** Save `duto.yml` and the change applies right away, without restarting: new tunnels open, removed ones close, and a new `port`, `host`, `headers`, `auth` or `allow` counts from the next request, on the same URL. Visitors signed in with a password stay signed in while their user is still in `auth`. A save with a mistake changes nothing: the tunnels keep the last valid config and the screen shows the error with its line until you save a fixed file. Tunnels opened with `n` on the screen are left alone. Saving `.env` or `.env.local` applies the file again with the new values.
 
 ### Host and headers
 
-By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.dev`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
+By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.page`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
 
 ```yaml
 tunnels:
@@ -79,7 +84,7 @@ tunnels:
 **What `host:` does:**
 
 - Your service receives the Host you set, and `X-Forwarded-Host` is not sent. To send it anyway, put it in `headers:`.
-- Redirects come back with the public address. A `Location: http://admin.myapp.test:8081/login` reaches the browser as `https://admin-<user>.duto.dev/login`. This also applies inside encoded parameters of the `Location`. To turn it off, set `rewrite_redirects: false` on the tunnel.
+- Redirects come back with the public address. A `Location: http://admin.myapp.test:8081/login` reaches the browser as `https://admin-<user>.duto.page/login`. This also applies inside encoded parameters of the `Location`. To turn it off, set `rewrite_redirects: false` on the tunnel.
 - Links in response bodies (HTML, JSON) are not rewritten. URLs your app builds from the Host only open on your machine.
 - On the command line: `duto 8081 --host admin.myapp.test`, and `--no-rewrite-redirects` to turn the swap off.
 
@@ -91,7 +96,7 @@ Ways out, from simplest to most work:
 2. If the app needs the local domain for other decisions and reads `X-Forwarded-Host`, pass the domain through `headers:` and keep the public Host.
 3. Set the public callback URL in the app, if it lets you.
 
-In every case, register `https://<name>-<user>.duto.dev/<callback path>` as the callback URL at the provider. The comparison is usually exact, with no wildcards: each person on the team has their own address.
+In every case, register `https://<name>-<user>.duto.page/<callback path>` as the callback URL at the provider. The comparison is usually exact, with no wildcards: each person on the team has their own address.
 
 **What you cannot set.** Some headers belong to Cloudflare, to Duto or to the HTTP connection itself. `duto.yml` refuses them, with the line and what to do:
 
@@ -153,12 +158,12 @@ People get in one of these ways:
 |---|---|
 | Person in a browser | Opens the URL, sees the "This tunnel is password protected" page and signs in with user and password |
 | Phone | Scans the QR code (key `m`, see below) and gets in without typing |
-| `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.dev/` (`Authorization: Basic`) |
+| `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.page/` (`Authorization: Basic`) |
 | An API that already uses `Authorization: Bearer` | Send `X-Duto-Auth: client:password`; the `Bearer` goes through to the app untouched |
 
 Without credentials, a browser is sent to the sign-in page and other clients get `401`. After 10 wrong passwords from one address in 5 minutes, that address is locked out for the rest of the window (the sign-in page answers `429` with `Retry-After`, other clients keep getting `401`). After 100 wrong passwords from all addresses, every password attempt is locked out the same way. A browser that already signed in keeps working. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
-**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
+**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.page` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 
 **QR code.** With the full screen open, key `m` shows the QR of the selected tunnel in place of the request list. On a tunnel without a password, the QR points to the tunnel URL. On a tunnel with a password, it points to a link that signs in directly, as the first user in the `auth` list. That link is valid for 5 minutes and for one device only: once opened, or after it expires, it falls back to the sign-in page. On the QR screen, `g` generates a new link (and invalidates the previous one) and `esc` goes back to the list.
 
@@ -231,7 +236,7 @@ The page has the list on the left and the details on the right, with the tabs **
 
 | Option | What it does |
 |---|---|
-| `--name <name>` | Fixed address `<name>-<user>.duto.dev` |
+| `--name <name>` | Fixed address `<name>-<user>.duto.page` |
 | `--host <host>` | Host the local service receives instead of the public one |
 | `--no-rewrite-redirects` | With `--host`, keep redirects as the service sent them |
 | `--auth <user:password>` | Ask for a username and password to open the address (repeatable) |

package/dist/{chunk-QFM4MUED.js → chunk-QMQWGCIE.js}

@@ -644,6 +644,8 @@ function reasonOf(c) {
   if (c.source === "headers") return c.kind === "remove" ? 'headers: ""' : "headers:";
   if (c.source === "host") return "host:";
   if (c.source === "visitor") return "from the visitor; set trust_forwarded: true to keep it";
+  if (c.source === "isolation" && c.name === "set-cookie") return "Domain=duto.page reaches every user's tunnel; kept on this address";
+  if (c.source === "isolation") return "from another user's tunnel; only SameSite=None cookies go through";
   return "Duto credential";
 }
 function valueOf(c) {

package/dist/{fullscreen-Q3RGW6NJ.js → fullscreen-GM4ZV6FW.js}

@@ -16,7 +16,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-QFM4MUED.js";
+} from "./chunk-QMQWGCIE.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   updateLine,
   validateName,
   warn
-} from "./chunk-QFM4MUED.js";
+} from "./chunk-QMQWGCIE.js";
 
 // src/index.ts
 import { hostname as hostname2 } from "os";
@@ -36,7 +36,7 @@ import { join as join7, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.8.0";
+var CLI_VERSION = "1.9.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.8.0",
+    cliVersion: "1.9.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -1729,7 +1729,7 @@ function redirectIssues(r, ctx) {
       {
         level: "warn",
         title: "Redirect drops to http",
-        detail: `Location is ${location}. duto.dev only serves https, so the browser takes an extra hop and loses POST bodies. Have the app trust X-Forwarded-Proto.`
+        detail: `Location is ${location}. Duto tunnels only serve https, so the browser takes an extra hop and loses POST bodies. Have the app trust X-Forwarded-Proto.`
       }
     ];
   }
@@ -2436,6 +2436,89 @@ function deliver(h, route) {
   return changes.length ? { headers: out, changes } : { headers: h, changes };
 }
 
+// src/session/siteIsolation.ts
+function firstLabel(host) {
+  return host.split(".")[0] ?? "";
+}
+function parentDomain(host) {
+  return host.slice(host.indexOf(".") + 1).toLowerCase();
+}
+function tunnelOwner(host) {
+  const label = firstLabel(host.toLowerCase());
+  return label.slice(label.lastIndexOf("-") + 1);
+}
+function originHost(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    return { origin: url.origin, host: url.hostname.toLowerCase() };
+  } catch {
+    return null;
+  }
+}
+function isSiblingTunnel(host, publicHost) {
+  const parent = parentDomain(publicHost);
+  if (!host.endsWith(`.${parent}`)) return false;
+  return !host.slice(0, -parent.length - 1).includes(".");
+}
+function crossUserOrigin(h, publicHost) {
+  const site = h["sec-fetch-site"];
+  if (site !== void 0 && site !== "same-site") return null;
+  const from = originHost(h.origin) ?? originHost(h.referer);
+  if (!from || !isSiblingTunnel(from.host, publicHost)) return null;
+  return tunnelOwner(from.host) === tunnelOwner(publicHost) ? null : from.origin;
+}
+function scopeSetCookies(lines, publicHost) {
+  const parent = parentDomain(publicHost);
+  const changes = [];
+  const scoped = lines.map((line) => {
+    const parts = line.split(";");
+    const kept = parts.filter((part, i) => {
+      if (i === 0) return true;
+      const [key = "", value = ""] = part.split("=");
+      const shared = key.trim().toLowerCase() === "domain" && value.trim().replace(/^\./, "").toLowerCase() === parent;
+      if (shared) changes.push({ kind: "remove", name: "set-cookie", from: `${parseSetCookie(line).name}: ${part.trim()}`, source: "isolation" });
+      return !shared;
+    });
+    return kept.length === parts.length ? line : kept.join(";");
+  });
+  return { lines: scoped, changes };
+}
+var SameSiteMemory = class {
+  byName = /* @__PURE__ */ new Map();
+  learn(setCookies) {
+    for (const line of setCookies) {
+      const c = parseSetCookie(line);
+      const value = typeof c.attrs.samesite === "string" ? c.attrs.samesite.toLowerCase() : "lax";
+      this.byName.set(c.name, value === "none" || value === "strict" ? value : "lax");
+    }
+  }
+  sentCrossSite(name, navigation) {
+    const sameSite = this.byName.get(name) ?? "lax";
+    return sameSite === "none" || navigation && sameSite === "lax";
+  }
+};
+function isNavigation(h, method) {
+  if (method !== "GET" && method !== "HEAD") return false;
+  const mode = h["sec-fetch-mode"];
+  return mode === "navigate" || mode === void 0 && h.origin === void 0;
+}
+function isolateCookies(h, publicHost, memory, method = "GET") {
+  const cookie = h.cookie;
+  const origin = cookie ? crossUserOrigin(h, publicHost) : null;
+  if (!cookie || !origin) return { headers: h, changes: [] };
+  const navigation = isNavigation(h, method);
+  const pairs = cookie.split(";").map((p) => p.trim()).filter(Boolean);
+  const nameOf = (pair2) => pair2.split("=")[0].trim();
+  const kept = pairs.filter((p) => memory.sentCrossSite(nameOf(p), navigation));
+  const removed = pairs.filter((p) => !kept.includes(p)).map(nameOf);
+  if (removed.length === 0) return { headers: h, changes: [] };
+  const headers = { ...h };
+  if (kept.length) headers.cookie = kept.join("; ");
+  else delete headers.cookie;
+  return { headers, changes: [{ kind: "remove", name: "cookie", from: `${removed.join(", ")} (from ${origin})`, source: "isolation" }] };
+}
+
 // src/session/errorPage.ts
 var esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 function wantsHtml(accept) {
@@ -2731,6 +2814,26 @@ function waitForService(res, port, checkMs, pingMs) {
 async function startProxy(o) {
   const max = o.maxBody ?? MAX_BODY;
   let nextId = 1;
+  const sameSite = /* @__PURE__ */ new Map();
+  function memoryOf(route) {
+    let memory = sameSite.get(route.tunnel);
+    if (!memory) sameSite.set(route.tunnel, memory = new SameSiteMemory());
+    return memory;
+  }
+  function deliverFor(req, route) {
+    const delivered = deliver(req.headers, route);
+    const isolated = isolateCookies(delivered.headers, hostOf(req), memoryOf(route), req.method ?? "GET");
+    return isolated.changes.length ? { headers: isolated.headers, changes: [...delivered.changes, ...isolated.changes] } : delivered;
+  }
+  function scopeResponseCookies(id, req, route, up) {
+    const lines = up.headers["set-cookie"];
+    if (!lines?.length) return;
+    memoryOf(route).learn(lines);
+    const scoped = scopeSetCookies(lines, hostOf(req));
+    if (!scoped.changes.length) return;
+    up.headers["set-cookie"] = scoped.lines;
+    o.store.update(id, { headerChanges: [...o.store.get(id)?.headerChanges ?? [], ...scoped.changes] });
+  }
   const routeWaitMs = o.routeWaitMs ?? DEFAULT_ROUTE_WAIT_MS;
   async function routeFor(req) {
     const host = hostOf(req);
@@ -2860,7 +2963,7 @@ async function startProxy(o) {
     }
     const preflight = !!route.auth && isPreflight(req.method, req.headers);
     const access = route.auth && !preflight ? route.auth.access(req.headers) : void 0;
-    const { headers, changes } = deliver(req.headers, route);
+    const { headers, changes } = deliverFor(req, route);
     if (access?.kind === "denied") {
       const html = wantsHtml(req.headers.accept);
       const { id: id2, started: started2 } = record(req, route, headers, changes, false, html ? void 0 : access, DENIED_NO_REPLAY);
@@ -2894,6 +2997,7 @@ async function startProxy(o) {
               o.store.update(id, { redirect: { from, to } });
             }
           }
+          scopeResponseCookies(id, req, route, up);
           res.writeHead(up.statusCode ?? 502, up.statusMessage, up.headers);
           trackResponse(id, started, up, reqCap);
           up.pipe(res);
@@ -2937,7 +3041,7 @@ async function startProxy(o) {
     const route = await routeFor(req);
     if (!route) return void client.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
     const access = route.auth?.access(req.headers);
-    const { headers, changes } = deliver(req.headers, route);
+    const { headers, changes } = deliverFor(req, route);
     const { id, started } = record(req, route, headers, changes, true, access, access?.kind === "denied" ? DENIED_NO_REPLAY : void 0);
     if (access?.kind === "denied") {
       client.end(WS_DENIED);
@@ -3584,7 +3688,7 @@ async function runSession(specs, source, flags, configPath) {
   const warnings = credentialWarnings(specs);
   const watcher = configPath ? watchConfig({ path: configPath, onChange: (next) => void session.apply(next).catch((err) => session.configFailed(err instanceof Error ? err.message : String(err))), onError: (error) => session.configFailed(error) }) : null;
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-Q3RGW6NJ.js");
+    const { runFullscreen } = await import("./fullscreen-GM4ZV6FW.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
     watcher?.close();
     await inspector?.close().catch(() => void 0);
@@ -3650,7 +3754,7 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
   return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "command line", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
+cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.page)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
 cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
 cli.command("login [token]", "Log in through the browser, or save an authtoken").action(async (token) => {
   try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.8.0",
-  "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
+  "version": "1.9.0",
+  "description": "Expose a local port at https://<name>-<user>.duto.page with one command.",
   "license": "MIT",
   "type": "module",
   "bin": {