@dutodev/cli 1.8.1 → 1.9.0

package/dist/{chunk-QFM4MUED.js → chunk-QMQWGCIE.js}

@@ -644,6 +644,8 @@ function reasonOf(c) {
   if (c.source === "headers") return c.kind === "remove" ? 'headers: ""' : "headers:";
   if (c.source === "host") return "host:";
   if (c.source === "visitor") return "from the visitor; set trust_forwarded: true to keep it";
+  if (c.source === "isolation" && c.name === "set-cookie") return "Domain=duto.page reaches every user's tunnel; kept on this address";
+  if (c.source === "isolation") return "from another user's tunnel; only SameSite=None cookies go through";
   return "Duto credential";
 }
 function valueOf(c) {

package/dist/{fullscreen-Q3RGW6NJ.js → fullscreen-GM4ZV6FW.js}

@@ -16,7 +16,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-QFM4MUED.js";
+} from "./chunk-QMQWGCIE.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   updateLine,
   validateName,
   warn
-} from "./chunk-QFM4MUED.js";
+} from "./chunk-QMQWGCIE.js";
 
 // src/index.ts
 import { hostname as hostname2 } from "os";
@@ -36,7 +36,7 @@ import { join as join7, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.8.1";
+var CLI_VERSION = "1.9.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.8.1",
+    cliVersion: "1.9.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -2436,6 +2436,89 @@ function deliver(h, route) {
   return changes.length ? { headers: out, changes } : { headers: h, changes };
 }
 
+// src/session/siteIsolation.ts
+function firstLabel(host) {
+  return host.split(".")[0] ?? "";
+}
+function parentDomain(host) {
+  return host.slice(host.indexOf(".") + 1).toLowerCase();
+}
+function tunnelOwner(host) {
+  const label = firstLabel(host.toLowerCase());
+  return label.slice(label.lastIndexOf("-") + 1);
+}
+function originHost(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    return { origin: url.origin, host: url.hostname.toLowerCase() };
+  } catch {
+    return null;
+  }
+}
+function isSiblingTunnel(host, publicHost) {
+  const parent = parentDomain(publicHost);
+  if (!host.endsWith(`.${parent}`)) return false;
+  return !host.slice(0, -parent.length - 1).includes(".");
+}
+function crossUserOrigin(h, publicHost) {
+  const site = h["sec-fetch-site"];
+  if (site !== void 0 && site !== "same-site") return null;
+  const from = originHost(h.origin) ?? originHost(h.referer);
+  if (!from || !isSiblingTunnel(from.host, publicHost)) return null;
+  return tunnelOwner(from.host) === tunnelOwner(publicHost) ? null : from.origin;
+}
+function scopeSetCookies(lines, publicHost) {
+  const parent = parentDomain(publicHost);
+  const changes = [];
+  const scoped = lines.map((line) => {
+    const parts = line.split(";");
+    const kept = parts.filter((part, i) => {
+      if (i === 0) return true;
+      const [key = "", value = ""] = part.split("=");
+      const shared = key.trim().toLowerCase() === "domain" && value.trim().replace(/^\./, "").toLowerCase() === parent;
+      if (shared) changes.push({ kind: "remove", name: "set-cookie", from: `${parseSetCookie(line).name}: ${part.trim()}`, source: "isolation" });
+      return !shared;
+    });
+    return kept.length === parts.length ? line : kept.join(";");
+  });
+  return { lines: scoped, changes };
+}
+var SameSiteMemory = class {
+  byName = /* @__PURE__ */ new Map();
+  learn(setCookies) {
+    for (const line of setCookies) {
+      const c = parseSetCookie(line);
+      const value = typeof c.attrs.samesite === "string" ? c.attrs.samesite.toLowerCase() : "lax";
+      this.byName.set(c.name, value === "none" || value === "strict" ? value : "lax");
+    }
+  }
+  sentCrossSite(name, navigation) {
+    const sameSite = this.byName.get(name) ?? "lax";
+    return sameSite === "none" || navigation && sameSite === "lax";
+  }
+};
+function isNavigation(h, method) {
+  if (method !== "GET" && method !== "HEAD") return false;
+  const mode = h["sec-fetch-mode"];
+  return mode === "navigate" || mode === void 0 && h.origin === void 0;
+}
+function isolateCookies(h, publicHost, memory, method = "GET") {
+  const cookie = h.cookie;
+  const origin = cookie ? crossUserOrigin(h, publicHost) : null;
+  if (!cookie || !origin) return { headers: h, changes: [] };
+  const navigation = isNavigation(h, method);
+  const pairs = cookie.split(";").map((p) => p.trim()).filter(Boolean);
+  const nameOf = (pair2) => pair2.split("=")[0].trim();
+  const kept = pairs.filter((p) => memory.sentCrossSite(nameOf(p), navigation));
+  const removed = pairs.filter((p) => !kept.includes(p)).map(nameOf);
+  if (removed.length === 0) return { headers: h, changes: [] };
+  const headers = { ...h };
+  if (kept.length) headers.cookie = kept.join("; ");
+  else delete headers.cookie;
+  return { headers, changes: [{ kind: "remove", name: "cookie", from: `${removed.join(", ")} (from ${origin})`, source: "isolation" }] };
+}
+
 // src/session/errorPage.ts
 var esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 function wantsHtml(accept) {
@@ -2731,6 +2814,26 @@ function waitForService(res, port, checkMs, pingMs) {
 async function startProxy(o) {
   const max = o.maxBody ?? MAX_BODY;
   let nextId = 1;
+  const sameSite = /* @__PURE__ */ new Map();
+  function memoryOf(route) {
+    let memory = sameSite.get(route.tunnel);
+    if (!memory) sameSite.set(route.tunnel, memory = new SameSiteMemory());
+    return memory;
+  }
+  function deliverFor(req, route) {
+    const delivered = deliver(req.headers, route);
+    const isolated = isolateCookies(delivered.headers, hostOf(req), memoryOf(route), req.method ?? "GET");
+    return isolated.changes.length ? { headers: isolated.headers, changes: [...delivered.changes, ...isolated.changes] } : delivered;
+  }
+  function scopeResponseCookies(id, req, route, up) {
+    const lines = up.headers["set-cookie"];
+    if (!lines?.length) return;
+    memoryOf(route).learn(lines);
+    const scoped = scopeSetCookies(lines, hostOf(req));
+    if (!scoped.changes.length) return;
+    up.headers["set-cookie"] = scoped.lines;
+    o.store.update(id, { headerChanges: [...o.store.get(id)?.headerChanges ?? [], ...scoped.changes] });
+  }
   const routeWaitMs = o.routeWaitMs ?? DEFAULT_ROUTE_WAIT_MS;
   async function routeFor(req) {
     const host = hostOf(req);
@@ -2860,7 +2963,7 @@ async function startProxy(o) {
     }
     const preflight = !!route.auth && isPreflight(req.method, req.headers);
     const access = route.auth && !preflight ? route.auth.access(req.headers) : void 0;
-    const { headers, changes } = deliver(req.headers, route);
+    const { headers, changes } = deliverFor(req, route);
     if (access?.kind === "denied") {
       const html = wantsHtml(req.headers.accept);
       const { id: id2, started: started2 } = record(req, route, headers, changes, false, html ? void 0 : access, DENIED_NO_REPLAY);
@@ -2894,6 +2997,7 @@ async function startProxy(o) {
               o.store.update(id, { redirect: { from, to } });
             }
           }
+          scopeResponseCookies(id, req, route, up);
           res.writeHead(up.statusCode ?? 502, up.statusMessage, up.headers);
           trackResponse(id, started, up, reqCap);
           up.pipe(res);
@@ -2937,7 +3041,7 @@ async function startProxy(o) {
     const route = await routeFor(req);
     if (!route) return void client.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
     const access = route.auth?.access(req.headers);
-    const { headers, changes } = deliver(req.headers, route);
+    const { headers, changes } = deliverFor(req, route);
     const { id, started } = record(req, route, headers, changes, true, access, access?.kind === "denied" ? DENIED_NO_REPLAY : void 0);
     if (access?.kind === "denied") {
       client.end(WS_DENIED);
@@ -3584,7 +3688,7 @@ async function runSession(specs, source, flags, configPath) {
   const warnings = credentialWarnings(specs);
   const watcher = configPath ? watchConfig({ path: configPath, onChange: (next) => void session.apply(next).catch((err) => session.configFailed(err instanceof Error ? err.message : String(err))), onError: (error) => session.configFailed(error) }) : null;
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-Q3RGW6NJ.js");
+    const { runFullscreen } = await import("./fullscreen-GM4ZV6FW.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
     watcher?.close();
     await inspector?.close().catch(() => void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Expose a local port at https://<name>-<user>.duto.page with one command.",
   "license": "MIT",
   "type": "module",