@hamedb89/localghost 0.1.6 → 0.1.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, unlinkSync } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7, unlinkSync } from "fs";
 import { Command, InvalidArgumentError } from "commander";
 
 // src/activity.ts
@@ -25,7 +25,7 @@ function isProcessRunning(pid) {
   }
 }
 function emptyActivity() {
-  return { version: LOCALGHOST_ACTIVITY_VERSION, runs: [] };
+  return { version: LOCALGHOST_ACTIVITY_VERSION, runs: [], setups: [] };
 }
 function readLocalghostActivity(path = getLocalghostActivityPath()) {
   if (!existsSync(path)) return emptyActivity();
@@ -33,7 +33,8 @@ function readLocalghostActivity(path = getLocalghostActivityPath()) {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
     return {
       version: LOCALGHOST_ACTIVITY_VERSION,
-      runs: Array.isArray(parsed.runs) ? parsed.runs : []
+      runs: Array.isArray(parsed.runs) ? parsed.runs : [],
+      setups: Array.isArray(parsed.setups) ? parsed.setups : []
     };
   } catch {
     return emptyActivity();
@@ -48,22 +49,29 @@ function writeLocalghostActivity(activity, path = getLocalghostActivityPath()) {
 function createRunId(input2, pid) {
   return `${input2.projectName}:${input2.mode}:${pid}:${Date.now()}`;
 }
+function createSetupId(input2) {
+  return `${input2.projectName}:${input2.cwd}:${input2.configPath ?? ""}`;
+}
 function pruneLocalghostActivity(path = getLocalghostActivityPath()) {
   const activity = readLocalghostActivity(path);
   const activeRuns = activity.runs.filter((run) => isProcessRunning(run.pid));
   const pruned = activeRuns.length !== activity.runs.length;
   if (pruned) {
-    writeLocalghostActivity({ version: LOCALGHOST_ACTIVITY_VERSION, runs: activeRuns }, path);
+    writeLocalghostActivity({ ...activity, version: LOCALGHOST_ACTIVITY_VERSION, runs: activeRuns }, path);
   }
   return {
     path,
     pruned,
-    runs: activeRuns
+    runs: activeRuns,
+    setups: activity.setups
   };
 }
 function listLocalghostRuns(path = getLocalghostActivityPath()) {
   return pruneLocalghostActivity(path).runs;
 }
+function listLocalghostSetups(path = getLocalghostActivityPath()) {
+  return pruneLocalghostActivity(path).setups;
+}
 function registerLocalghostRun(input2, path = getLocalghostActivityPath()) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const pid = input2.pid ?? process.pid;
@@ -87,14 +95,43 @@ function registerLocalghostRun(input2, path = getLocalghostActivityPath()) {
     entries: input2.entries
   };
   const current = pruneLocalghostActivity(path).runs.filter((run) => run.id !== record.id);
-  writeLocalghostActivity({ version: LOCALGHOST_ACTIVITY_VERSION, runs: [...current, record] }, path);
+  const activity = readLocalghostActivity(path);
+  writeLocalghostActivity({ version: LOCALGHOST_ACTIVITY_VERSION, runs: [...current, record], setups: activity.setups }, path);
+  return record;
+}
+function registerLocalghostSetup(input2, path = getLocalghostActivityPath()) {
+  const record = {
+    id: input2.id ?? createSetupId(input2),
+    cwd: input2.cwd,
+    projectName: input2.projectName,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...input2.configPath ? { configPath: input2.configPath } : {},
+    ...input2.caddyfilePath ? { caddyfilePath: input2.caddyfilePath } : {},
+    ...typeof input2.https === "boolean" ? { https: input2.https } : {},
+    entries: input2.entries
+  };
+  const activity = pruneLocalghostActivity(path);
+  const setups = activity.setups.filter((setup) => setup.id !== record.id);
+  writeLocalghostActivity({ version: LOCALGHOST_ACTIVITY_VERSION, runs: activity.runs, setups: [...setups, record] }, path);
   return record;
 }
 function unregisterLocalghostRun(id, path = getLocalghostActivityPath()) {
   const activity = readLocalghostActivity(path);
   const runs = activity.runs.filter((run) => run.id !== id);
   if (runs.length !== activity.runs.length) {
-    writeLocalghostActivity({ version: LOCALGHOST_ACTIVITY_VERSION, runs }, path);
+    writeLocalghostActivity({ ...activity, version: LOCALGHOST_ACTIVITY_VERSION, runs }, path);
+  }
+}
+function unregisterLocalghostSetup(options, path = getLocalghostActivityPath()) {
+  const activity = readLocalghostActivity(path);
+  const setups = activity.setups.filter((setup) => {
+    if (setup.cwd !== options.cwd) return true;
+    if (options.projectName && setup.projectName !== options.projectName) return true;
+    if (options.configPath && setup.configPath !== options.configPath) return true;
+    return false;
+  });
+  if (setups.length !== activity.setups.length) {
+    writeLocalghostActivity({ ...activity, version: LOCALGHOST_ACTIVITY_VERSION, setups }, path);
   }
 }
 
@@ -280,6 +317,17 @@ function startCaddy(path) {
     stdio: "inherit"
   });
 }
+async function trustCaddy(path) {
+  await execa("caddy", ["trust", "--config", path], {
+    cwd: dirname3(path),
+    stdio: "inherit"
+  });
+}
+
+// src/context.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+import { pathToFileURL } from "url";
 
 // src/port.ts
 import { createServer } from "net";
@@ -307,7 +355,263 @@ async function findAvailablePort(startPort, options = {}) {
   throw new Error(`No available port found from ${startPort} to ${startPort + maxAttempts - 1}.`);
 }
 
+// src/tunnel.ts
+import { domainToASCII } from "url";
+var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
+var DEFAULT_GHOST_TUNNEL_MODE = "manual";
+function isResolvedGhostTunnelConfig(value) {
+  return typeof value === "object" && value !== null && "enabled" in value;
+}
+function toGhostTunnelConfig(options) {
+  return isResolvedGhostTunnelConfig(options) ? options : resolveGhostTunnelConfig(options);
+}
+function stripHostPort(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed.startsWith("[") || trimmed.includes("/")) return "";
+  const portSeparator = trimmed.lastIndexOf(":");
+  if (portSeparator === -1) return trimmed;
+  const port = trimmed.slice(portSeparator + 1);
+  return /^\d+$/.test(port) ? trimmed.slice(0, portSeparator) : trimmed;
+}
+function normalizeDomain(value) {
+  const host = stripHostPort(value.replace(/^\*\./, ""));
+  const ascii = domainToASCII(host);
+  if (!ascii || ascii.length > 253 || ascii.includes("..")) return null;
+  if (ascii.startsWith(".") || ascii.endsWith(".")) return null;
+  if (ascii.includes("*")) return null;
+  if (!ascii.split(".").every(isValidHostLabel)) return null;
+  return ascii;
+}
+function isValidHostLabel(value) {
+  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function isValidNamespaceTag(value) {
+  return /^[a-z][a-z0-9_]*$/i.test(value);
+}
+function isNamespaceTagList(options) {
+  return Array.isArray(options);
+}
+function assertValidSubdomain(value) {
+  if (!isValidHostLabel(value)) {
+    throw new Error(`Invalid ghost tunnel subdomain: ${value}`);
+  }
+}
+function normalizeDomains(domains) {
+  const values = typeof domains === "string" ? [domains] : [...domains ?? []];
+  const normalized = values.map((value) => value.trim()).filter(Boolean).map((value) => {
+    const domain = normalizeDomain(value);
+    if (!domain) throw new Error(`Invalid ghost tunnel domain: ${value}`);
+    return domain;
+  });
+  return [...new Set(normalized)];
+}
+function parseGhostTunnelMode(value) {
+  return value ?? DEFAULT_GHOST_TUNNEL_MODE;
+}
+function resolveNamespaceConfig(options) {
+  const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
+  let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+  let spreadTag = tags.includes("project") ? "project" : void 0;
+  if (options && !isNamespaceTagList(options)) {
+    separator = options.separator ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+    spreadTag = options.spreadTag === false ? false : options.spreadTag ?? spreadTag;
+  }
+  if (tags.length === 0) {
+    throw new Error("Ghost tunnel namespace must include at least one tag.");
+  }
+  for (const tag of tags) {
+    if (!isValidNamespaceTag(tag)) {
+      throw new Error(`Invalid ghost tunnel namespace tag: ${tag}`);
+    }
+  }
+  if (spreadTag && !tags.includes(spreadTag)) {
+    throw new Error(`Ghost tunnel namespace spreadTag must be listed in tags: ${spreadTag}`);
+  }
+  if (!separator || separator.length > 8 || !/^[a-z0-9-]+$/.test(separator)) {
+    throw new Error(`Invalid ghost tunnel namespace separator: ${separator}`);
+  }
+  return {
+    tags,
+    separator,
+    ...spreadTag ? { spreadTag } : {}
+  };
+}
+function normalizeNamespaceValue(tag, value, separator, options = {}) {
+  const normalized = normalizeDomain(value);
+  if (!normalized || normalized.includes(".")) {
+    throw new Error(`Invalid ghost tunnel namespace value for ${tag}: ${value}`);
+  }
+  if (!options.allowSeparator && normalized.includes(separator)) {
+    throw new Error(`Ghost tunnel namespace value for ${tag} cannot include separator "${separator}": ${value}`);
+  }
+  return normalized;
+}
+function createNamespaceSlug(config, values) {
+  const parts = config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) {
+      throw new Error(`Missing ghost tunnel namespace value: ${tag}`);
+    }
+    return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
+  });
+  const slug = parts.join(config.separator);
+  if (!isValidHostLabel(slug)) {
+    throw new Error(`Ghost tunnel namespace is too long for a DNS label: ${slug}`);
+  }
+  return slug;
+}
+function createNamespaceDisplaySlug(config, values = {}) {
+  return config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) return `<${tag}>`;
+    try {
+      return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
+    } catch {
+      return `<${tag}>`;
+    }
+  }).join(config.separator);
+}
+function getPreviewDefaults(preview, defaults) {
+  return {
+    domain: preview?.domain ?? defaults?.domain,
+    route: preview?.route ?? defaults?.route,
+    project: preview?.project ?? defaults?.project,
+    owner: preview?.owner ?? defaults?.owner,
+    values: {
+      ...defaults?.values ?? {},
+      ...preview?.values ?? {}
+    },
+    path: preview?.path,
+    protocol: preview?.protocol
+  };
+}
+function getDisplayValues(input2) {
+  return {
+    ...input2.route ? { route: input2.route } : {},
+    ...input2.project ? { project: input2.project } : {},
+    ...input2.owner ? { owner: input2.owner } : {},
+    ...input2.values
+  };
+}
+function createDisplayUrl(config, defaults, domain) {
+  const input2 = getPreviewDefaults(config.preview, defaults);
+  const protocol = input2.protocol ?? "https";
+  const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input2));
+  const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input2.domain ? getGhostTunnelEntryHost(input2.domain, config) : `${config.subdomain}.*`;
+  const url = `${protocol}://${slug}.${entryHost}/`;
+  if (!input2.path) return url;
+  return `${url}${input2.path.replace(/^\/+/, "")}`;
+}
+function createDisplayUrls(config, defaults) {
+  const domains = config.domains.length > 0 ? config.domains : defaults?.domain ? [defaults.domain] : [];
+  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, defaults, domain)) : [createDisplayUrl(config, defaults)];
+  return [...new Set(urls)];
+}
+function maybeConstructPreviewUrl(config, defaults) {
+  if (!config.preview) return void 0;
+  const input2 = getPreviewDefaults(config.preview, defaults);
+  if (!input2.domain || !input2.route || !input2.project || !input2.owner) return void 0;
+  return constructGhostTunnelUrl({
+    domain: input2.domain,
+    route: input2.route,
+    project: input2.project,
+    owner: input2.owner,
+    values: input2.values,
+    ...input2.path ? { path: input2.path } : {},
+    ...input2.protocol ? { protocol: input2.protocol } : {},
+    ghostTunnel: config
+  });
+}
+function resolveGhostTunnelConfig(options, defaults) {
+  if (options === false || typeof options === "undefined") {
+    return {
+      enabled: false,
+      mode: DEFAULT_GHOST_TUNNEL_MODE,
+      domains: [],
+      subdomain: DEFAULT_GHOST_TUNNEL_SUBDOMAIN,
+      namespace: resolveNamespaceConfig(void 0),
+      displayUrls: [],
+      requireHttps: true,
+      requireAuth: true
+    };
+  }
+  const config = typeof options === "string" ? { mode: options } : options;
+  const subdomain = config.subdomain ?? DEFAULT_GHOST_TUNNEL_SUBDOMAIN;
+  assertValidSubdomain(subdomain);
+  const domains = normalizeDomains(config.domains);
+  const enabled = config.enabled ?? true;
+  const resolved = {
+    enabled,
+    mode: parseGhostTunnelMode(config.mode),
+    domains,
+    subdomain,
+    namespace: resolveNamespaceConfig(config.namespace),
+    ...config.preview ? { preview: config.preview } : {},
+    displayUrls: [],
+    requireHttps: config.requireHttps ?? true,
+    requireAuth: config.requireAuth ?? true
+  };
+  if (!enabled) {
+    return resolved;
+  }
+  const previewUrl = maybeConstructPreviewUrl(resolved, defaults);
+  const displayUrls = previewUrl ? [previewUrl] : createDisplayUrls(resolved, defaults);
+  return {
+    ...resolved,
+    displayUrls,
+    ...displayUrls[0] ? { displayUrl: displayUrls[0] } : {},
+    ...previewUrl ? { previewUrl } : {}
+  };
+}
+function getGhostTunnelEntryHost(domain, options = {}) {
+  const config = toGhostTunnelConfig(options);
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedDomain) {
+    throw new Error(`Invalid ghost tunnel domain: ${domain}`);
+  }
+  return `${config.subdomain}.${normalizedDomain}`;
+}
+function constructGhostTunnelHost(input2) {
+  const config = toGhostTunnelConfig(input2.ghostTunnel ?? {});
+  if (!config.enabled) {
+    throw new Error("Ghost tunnel is not enabled.");
+  }
+  const namespaceValues = {
+    route: input2.route,
+    project: input2.project,
+    owner: input2.owner,
+    ...input2.values ?? {}
+  };
+  const slug = createNamespaceSlug(config.namespace, namespaceValues);
+  return `${slug}.${getGhostTunnelEntryHost(input2.domain, config)}`;
+}
+function constructGhostTunnelUrl(input2) {
+  const protocol = input2.protocol ?? "https";
+  const host = constructGhostTunnelHost(input2);
+  const url = new URL(`${protocol}://${host}/`);
+  if (input2.path) {
+    url.pathname = `/${input2.path.replace(/^\/+/, "")}`;
+  }
+  if (input2.searchParams instanceof URLSearchParams) {
+    url.search = input2.searchParams.toString();
+  } else if (input2.searchParams) {
+    for (const [key, value] of Object.entries(input2.searchParams)) {
+      if (typeof value !== "undefined" && value !== null) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+  }
+  return url.toString();
+}
+
 // src/context.ts
+var LOCALGHOST_PROJECT_CONFIG_FILES = [
+  "localghost.config.mjs",
+  "localghost.config.js",
+  "localghost.config.cjs"
+];
 function parsePort(value) {
   if (!value) return void 0;
   const port = Number.parseInt(value, 10);
@@ -321,6 +625,30 @@ function envDynamicPort() {
   if (!value) return void 0;
   return ["1", "true", "yes", "on"].includes(value.toLowerCase());
 }
+function envHttps() {
+  const value = process.env.LOCALGHOST_HTTPS;
+  if (!value) return void 0;
+  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
+}
+function getPackageName(cwd) {
+  try {
+    const pkg = JSON.parse(readFileSync4(join4(cwd, "package.json"), "utf8"));
+    return typeof pkg.name === "string" ? pkg.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function getPackageOwner(cwd) {
+  const packageName = getPackageName(cwd);
+  if (!packageName?.startsWith("@")) return void 0;
+  return packageName.slice(1).split("/")[0];
+}
+function getLocalOwner(cwd) {
+  return sanitizeProjectName(process.env.LOCALGHOST_OWNER ?? getPackageOwner(cwd) ?? process.env.USER ?? process.env.USERNAME ?? "local");
+}
+function getRouteName(primaryHost, fallback) {
+  return sanitizeProjectName(primaryHost.split(".")[0] ?? fallback);
+}
 function readOptionsFromContext(options) {
   return {
     cwd: options.cwd ?? process.cwd(),
@@ -338,22 +666,68 @@ function withRuntimePort(entries, requestedPort, port) {
 function uniqueHosts(entries) {
   return [...new Set(entries.map((entry) => entry.host))];
 }
+function isAliasableHost(host) {
+  return host.includes(".") && !host.startsWith("www.") && !host.includes(":");
+}
+function getDefaultWwwAlias(host) {
+  return isAliasableHost(host) ? `www.${host}` : null;
+}
+function addDefaultWwwAliases(entries) {
+  const seen = new Set(entries.map((entry) => entry.host));
+  const aliases = [];
+  for (const entry of entries) {
+    const alias = getDefaultWwwAlias(entry.host);
+    if (alias && !seen.has(alias)) {
+      aliases.push({ host: alias, port: entry.port, target: `127.0.0.1:${entry.port}` });
+      seen.add(alias);
+    }
+  }
+  return [...entries, ...aliases];
+}
+function defined(input2) {
+  return Object.fromEntries(Object.entries(input2).filter(([, value]) => typeof value !== "undefined"));
+}
+async function readLocalghostProjectConfig(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  if (options.configFile === false) return { config: {} };
+  const candidates = options.configFile ? [options.configFile] : LOCALGHOST_PROJECT_CONFIG_FILES;
+  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync3(candidate));
+  if (!path) return { config: {} };
+  const imported = await import(`${pathToFileURL(path).href}?localghost=${Date.now()}`);
+  const config = imported.default ?? imported;
+  return { config, path };
+}
 async function resolveLocalghostContext(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const readOptions = readOptionsFromContext({ ...options, cwd });
+  const projectConfig = await readLocalghostProjectConfig({
+    cwd,
+    ...typeof options.localghostConfig !== "undefined" ? { configFile: options.localghostConfig } : {}
+  });
+  const merged = {
+    ...projectConfig.config,
+    ...defined(options)
+  };
+  const readOptions = readOptionsFromContext({ ...merged, cwd });
   const resolvedPath = resolveDevHostsPath(readOptions);
   const configEntries = readDevHosts(readOptions);
-  const requestedPort = options.port ?? envPort() ?? configEntries[0]?.port ?? 5173;
-  const dynamicPort = options.dynamicPort ?? envDynamicPort() ?? false;
-  const bindHost = options.bindHost ?? "127.0.0.1";
+  const requestedPort = merged.port ?? envPort() ?? configEntries[0]?.port ?? 5173;
+  const dynamicPort = merged.dynamicPort ?? envDynamicPort() ?? true;
+  const bindHost = merged.bindHost ?? "127.0.0.1";
   const probeHost = typeof bindHost === "string" ? bindHost : "127.0.0.1";
   const port = dynamicPort ? await findAvailablePort(requestedPort, { host: probeHost }) : requestedPort;
-  const entries = withRuntimePort(configEntries, requestedPort, port);
+  const wwwAlias = merged.wwwAlias ?? true;
+  const entries = wwwAlias ? addDefaultWwwAliases(withRuntimePort(configEntries, requestedPort, port)) : withRuntimePort(configEntries, requestedPort, port);
   const hosts = uniqueHosts(entries);
-  const primaryHost = options.primaryHost ?? entries.find((entry) => entry.port === port)?.host ?? hosts[0] ?? `${sanitizeProjectName(getProjectName(cwd))}.localhost`;
+  const primaryHost = merged.primaryHost ?? entries.find((entry) => entry.port === port)?.host ?? hosts[0] ?? `${sanitizeProjectName(getProjectName(cwd))}.localhost`;
+  const projectName = sanitizeProjectName(merged.project ?? getProjectName(cwd));
+  const ghostTunnel = resolveGhostTunnelConfig(merged.ghostTunnel, {
+    route: getRouteName(primaryHost, projectName),
+    project: projectName,
+    owner: getLocalOwner(cwd)
+  });
   return {
     cwd,
-    projectName: sanitizeProjectName(options.project ?? getProjectName(cwd)),
+    projectName,
     readOptions,
     configPath: resolvedPath.path,
     configFileName: resolvedPath.fileName,
@@ -365,7 +739,10 @@ async function resolveLocalghostContext(options = {}) {
     dynamicPort,
     bindHost,
     primaryHost,
-    https: options.https === true
+    https: merged.https ?? envHttps() ?? false,
+    wwwAlias,
+    ghostTunnel,
+    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {}
   };
 }
 
@@ -415,7 +792,7 @@ function assertLocalDevelopment(command, env = process.env) {
 // src/hosts-file.ts
 import { writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { execa as execa3 } from "execa";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -457,7 +834,7 @@ function removeManagedBlock(existing, projectName) {
 }
 async function writeSystemHostsFile(hostsPath, next, projectName) {
   const sanitizedProjectName = sanitizeProjectName(projectName);
-  const tempPath = join4(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
+  const tempPath = join5(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
   writeFileSync3(tempPath, next, "utf8");
   if (process.platform === "win32") {
     throw new Error(`Windows support: run as administrator and copy ${tempPath} to ${hostsPath}.`);
@@ -490,11 +867,11 @@ async function removeSystemHosts(projectName) {
 }
 
 // src/init.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 function detectPackageManager(cwd = process.cwd()) {
-  if (existsSync3(join5(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync3(join5(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync4(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync4(join6(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function packageRunCommand(packageManager, script) {
@@ -514,7 +891,7 @@ function renderConfig(options) {
 }
 function readPackageJson(path) {
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -538,6 +915,7 @@ function updatePackageScripts(packageJsonPath, configFile) {
     "localghost:proxy:https": scripts["localghost:proxy:https"] ?? `localghost dev${configFlag} --https`,
     "localghost:run": scripts["localghost:run"] ?? `localghost run${configFlag} --`,
     "localghost:ready": scripts["localghost:ready"] ?? `localghost status${configFlag} --ready`,
+    "localghost:trust": scripts["localghost:trust"] ?? `localghost trust${configFlag}`,
     "localghost:ps": scripts["localghost:ps"] ?? "localghost ps",
     "localghost:print": scripts["localghost:print"] ?? `localghost print${configFlag}`,
     "localghost:routes": scripts["localghost:routes"] ?? `localghost routes${configFlag}`,
@@ -565,8 +943,8 @@ function initLocalghost(options = {}) {
   const apiPort = options.apiPort ?? 8787;
   const packageManager = options.packageManager ?? detectPackageManager(cwd);
   const configFile = options.configFile ?? LOCALGHOST_CONFIG_FILE;
-  const configPath = join5(cwd, configFile);
-  const configExists = existsSync3(configPath);
+  const configPath = join6(cwd, configFile);
+  const configExists = existsSync4(configPath);
   if (configExists && !options.force) {
     return {
       configPath,
@@ -582,12 +960,12 @@ function initLocalghost(options = {}) {
     };
   }
   writeTextFile(configPath, renderConfig({ host, port, apiHost, apiPort }));
-  const packageJsonPath = join5(cwd, "package.json");
+  const packageJsonPath = join6(cwd, "package.json");
   const packageJsonChanged = options.writeScripts ? updatePackageScripts(packageJsonPath, configFile) : false;
   return {
     configPath,
     configCreated: true,
-    ...existsSync3(packageJsonPath) ? { packageJsonPath } : {},
+    ...existsSync4(packageJsonPath) ? { packageJsonPath } : {},
     packageJsonChanged,
     packageManager,
     nextSteps: [
@@ -623,6 +1001,20 @@ async function confirm(question, defaultValue = true) {
 }
 
 // src/routes.ts
+var ansi = {
+  cyan: "\x1B[36m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  reset: "\x1B[0m",
+  yellow: "\x1B[33m"
+};
+function colorize(value, color, enabled) {
+  return enabled ? `${color}${value}${ansi.reset}` : value;
+}
+function colorizeUrl(value, enabled) {
+  if (!enabled) return value;
+  return colorize(value.replace(/\*/g, `${ansi.yellow}*${ansi.cyan}`), ansi.cyan, enabled);
+}
 function getDomainRoutes(entries, options = {}) {
   const protocol = options.https === true ? "https" : "http";
   return [...entries].sort((left, right) => left.host.localeCompare(right.host) || left.port - right.port).map((entry) => ({
@@ -642,32 +1034,64 @@ function formatDomainRoutes(entries, options = {}) {
     ...routes.map((route) => `  ${route.url} -> ${route.upstream}`)
   ].join("\n");
 }
+function formatGhostTunnel(config, options = {}) {
+  if (!config.enabled) return null;
+  const color = options.color === true;
+  const label = options.label ?? "expected";
+  const labelColor = label === "running" ? ansi.green : ansi.dim;
+  const lines = [
+    "localghost ghost tunnel",
+    `  mode: ${config.mode}`
+  ];
+  const urls = config.displayUrls.length > 0 ? config.displayUrls : config.displayUrl ? [config.displayUrl] : [];
+  if (urls.length === 0) {
+    lines.push(`  ${label}: unavailable`);
+  } else if (urls.length === 1) {
+    lines.push(`  ${colorize(label, labelColor, color)}: ${colorizeUrl(urls[0], color)}`);
+  } else {
+    lines.push(`  ${colorize(label, labelColor, color)}:`);
+    for (const url of urls) {
+      lines.push(`    ${colorizeUrl(url, color)}`);
+    }
+  }
+  if (options.verbose) {
+    lines.push(`  domains: ${config.domains.length > 0 ? config.domains.join(", ") : "*"}`);
+    lines.push(`  access: ${config.requireAuth ? "auth required" : "app decides"}`);
+    lines.push(`  transport: ${config.requireHttps ? "https required" : "http allowed"}`);
+  }
+  return lines.join("\n");
+}
 
 // src/state.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join7 } from "path";
 var LOCALGHOST_STATE_FILE = "ops/local/localghost-state.json";
 function getLocalghostStatePath(cwd = process.cwd()) {
-  return join6(cwd, LOCALGHOST_STATE_FILE);
+  return join7(cwd, LOCALGHOST_STATE_FILE);
 }
 function readLocalghostState(cwd = process.cwd()) {
   const path = getLocalghostStatePath(cwd);
-  if (!existsSync4(path)) return null;
+  if (!existsSync5(path)) return null;
   return JSON.parse(readTextFile(path));
 }
 function writeLocalghostState(cwd, state) {
   const path = getLocalghostStatePath(cwd);
-  writeTextFile(path, `${JSON.stringify({ version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), ...state }, null, 2)}
+  writeTextFile(path, `${JSON.stringify({ ...state, version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
   return path;
 }
+function patchLocalghostState(cwd, patch) {
+  const current = readLocalghostState(cwd);
+  if (!current) return null;
+  return writeLocalghostState(cwd, { ...current, ...patch });
+}
 
 // src/update-check.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname4, join as join8 } from "path";
 var LOCALGHOST_PACKAGE_NAME = "@hamedb89/localghost";
-var LOCALGHOST_VERSION = "0.1.6";
+var LOCALGHOST_VERSION = "0.1.9";
 var UPDATE_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_NOTIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_TIMEOUT_MS = 900;
@@ -679,13 +1103,13 @@ function isUpdateCheckDisabled(env = process.env) {
 }
 function getUpdateCheckCachePath(env = process.env) {
   if (env.LOCALGHOST_UPDATE_CHECK_CACHE) return env.LOCALGHOST_UPDATE_CHECK_CACHE;
-  const cacheRoot = env.XDG_CACHE_HOME || join7(homedir2(), ".cache");
-  return join7(cacheRoot, "localghost", "update-check.json");
+  const cacheRoot = env.XDG_CACHE_HOME || join8(homedir2(), ".cache");
+  return join8(cacheRoot, "localghost", "update-check.json");
 }
 function readCache(path = getUpdateCheckCachePath()) {
-  if (!existsSync5(path)) return null;
+  if (!existsSync6(path)) return null;
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return null;
   }
@@ -839,8 +1263,18 @@ function warnAboutLocalMdns(entries) {
     );
   }
 }
+function shouldColor() {
+  return process.stdout.isTTY && !process.env.NO_COLOR;
+}
 function logDomainRoutes(entries, options = {}) {
   console.log(formatDomainRoutes(entries, options));
+  if (options.ghostTunnel?.enabled) {
+    console.log(formatGhostTunnel(options.ghostTunnel, {
+      color: shouldColor(),
+      label: "expected",
+      verbose: options.verbose === true
+    }));
+  }
 }
 function parsePort2(value) {
   const port = Number.parseInt(value, 10);
@@ -864,6 +1298,15 @@ function parseBooleanLike(value) {
   if (["0", "false", "no", "n", "off"].includes(normalized)) return false;
   throw new InvalidArgumentError("Value must be yes or no.");
 }
+function contextOptionsFromCli(options) {
+  return {
+    cwd: options.cwd,
+    ...options.project ? { project: options.project } : {},
+    ...options.config && options.config.length > 0 ? { configFiles: options.config } : {},
+    ...options.configPattern ? { configPattern: options.configPattern } : {},
+    ...useHttps(options) ? { https: true } : {}
+  };
+}
 function readOptionsFromCli(options) {
   return {
     cwd: options.cwd,
@@ -880,10 +1323,22 @@ async function assertCaddyReady() {
     "Localghost will not install it for you. No surprise spells."
   ].join("\n"));
 }
+function existingTrustMarkers(cwd) {
+  const state = readLocalghostState(cwd);
+  return {
+    ...state?.caddyTrustedAt ? { caddyTrustedAt: state.caddyTrustedAt } : {},
+    ...state?.caddyTrustPromptedAt ? { caddyTrustPromptedAt: state.caddyTrustPromptedAt } : {}
+  };
+}
 function explainHostsPassword() {
   console.log("Localghost may ask for your password to update its managed block in /etc/hosts.");
   console.log("It will only touch the lines between # localghost:start and # localghost:end.");
 }
+function explainTrustPassword() {
+  console.log("Localghost can trust Caddy's local HTTPS CA so browsers stop showing local certificate warnings.");
+  console.log("macOS may ask for your password to add that local CA to Keychain.");
+  console.log("This only affects Caddy's local development certificates on this machine.");
+}
 function useHttps(options) {
   return options.https === true || options.ssl === true;
 }
@@ -895,10 +1350,10 @@ function getSetupCommand(options) {
   return `localghost setup${configFlags}${options.https ? " --https" : ""}`;
 }
 function getSetupReadiness(options) {
-  const projectName = sanitizeProjectName(options.project ?? getProjectName(options.cwd));
+  const projectName = sanitizeProjectName(options.projectName ?? options.project ?? getProjectName(options.cwd));
   const readOptions = readOptionsFromCli(options);
-  const entries = readDevHosts(readOptions);
-  const configPath = resolveDevHostsPath(readOptions).path;
+  const entries = options.entries ?? readDevHosts(readOptions);
+  const configPath = options.configPath ?? resolveDevHostsPath(readOptions).path;
   const caddyfilePath = getCaddyfilePath(options.cwd);
   const statePath = getLocalghostStatePath(options.cwd);
   const state = readLocalghostState(options.cwd);
@@ -913,7 +1368,7 @@ function getSetupReadiness(options) {
   }
   const hostsPath = getSystemHostsPath();
   try {
-    const hosts = readFileSync6(hostsPath, "utf8");
+    const hosts = readFileSync7(hostsPath, "utf8");
     const expectedHostsBlock = renderHostsBlock(projectName, entries).trimEnd();
     if (!hosts.includes(expectedHostsBlock)) {
       reasons.push(`The Localghost hosts block in ${hostsPath} is missing or stale.`);
@@ -923,11 +1378,11 @@ function getSetupReadiness(options) {
     reasons.push(`Could not read ${hostsPath}: ${message}`);
   }
   if (!options.ignoreCaddyfile) {
-    if (!existsSync6(caddyfilePath)) {
+    if (!existsSync7(caddyfilePath)) {
       reasons.push(`Missing Caddyfile at ${caddyfilePath}.`);
     } else {
       const expectedCaddyfile = renderCaddyfile(entries, { https });
-      const currentCaddyfile = readFileSync6(caddyfilePath, "utf8");
+      const currentCaddyfile = readFileSync7(caddyfilePath, "utf8");
       if (currentCaddyfile !== expectedCaddyfile) {
         reasons.push(`Caddyfile at ${caddyfilePath} is stale for ${https ? "HTTPS" : "HTTP"} mode.`);
       }
@@ -959,8 +1414,49 @@ async function runSetupFromReadiness(cwd, https, readiness) {
     ...hostsResult.tempPath ? { hostsTempPath: hostsResult.tempPath } : {},
     caddyfilePath,
     caddyHttps: https,
+    ...existingTrustMarkers(cwd),
     entries: readiness.entries
   });
+  registerLocalghostSetup({
+    cwd,
+    projectName: readiness.projectName,
+    configPath: readiness.configPath,
+    caddyfilePath,
+    https,
+    entries: readiness.entries
+  });
+}
+function wait(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function runTrust(cwd, caddyfilePath) {
+  await wait(350);
+  try {
+    await trustCaddy(caddyfilePath);
+  } catch {
+    await wait(750);
+    await trustCaddy(caddyfilePath);
+  }
+  patchLocalghostState(cwd, { caddyTrustedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  console.log("Local HTTPS trust is ready.");
+}
+async function maybeTrustCaddy(options) {
+  if (!options.https) return;
+  const state = readLocalghostState(options.cwd);
+  if (!options.trust && state?.caddyTrustedAt) return;
+  let shouldTrust = options.trust === true;
+  if (!shouldTrust) {
+    if (state?.caddyTrustPromptedAt || !canPrompt()) return;
+    explainTrustPassword();
+    shouldTrust = await confirm("Trust local HTTPS certificates now?", true);
+  }
+  if (!shouldTrust) {
+    patchLocalghostState(options.cwd, { caddyTrustPromptedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    console.log("Okay. Localghost will still run HTTPS, but the browser may show a certificate warning.");
+    console.log("Run localghost trust when you want to trust Caddy's local CA.");
+    return;
+  }
+  await runTrust(options.cwd, options.caddyfilePath);
 }
 function maybePid(pid) {
   return typeof pid === "number" && Number.isInteger(pid) && pid > 0 ? pid : void 0;
@@ -978,35 +1474,91 @@ function registerCleanup(id) {
     process.off("exit", cleanup);
   };
 }
-async function getRunView(run) {
+async function getRouteViews(entries) {
   const portStatus = /* @__PURE__ */ new Map();
-  for (const entry of run.entries) {
+  for (const entry of entries) {
     if (!portStatus.has(entry.port)) {
       portStatus.set(entry.port, !await isPortAvailable(entry.port));
     }
   }
+  return entries.map((entry) => ({
+    host: entry.host,
+    port: entry.port,
+    target: `127.0.0.1:${entry.port}`,
+    listening: portStatus.get(entry.port) ?? false
+  }));
+}
+function setupKey(input2) {
+  return `${input2.projectName}:${input2.cwd}:${input2.configPath ?? ""}`;
+}
+function runKey(input2) {
+  return `${input2.projectName}:${input2.cwd}:${input2.configPath ?? ""}`;
+}
+async function getInstanceViews(setups, runs) {
+  const runBySetup = new Map(runs.map((run) => [runKey(run), run]));
+  const instances = [];
+  for (const setup of setups) {
+    const run = runBySetup.get(setupKey(setup));
+    if (run) {
+      instances.push(await getRunInstanceView(run, setup));
+      runBySetup.delete(setupKey(setup));
+      continue;
+    }
+    instances.push({
+      id: setup.id,
+      cwd: setup.cwd,
+      projectName: setup.projectName,
+      running: false,
+      mode: "setup",
+      updatedAt: setup.updatedAt,
+      ...setup.configPath ? { configPath: setup.configPath } : {},
+      ...setup.caddyfilePath ? { caddyfilePath: setup.caddyfilePath } : {},
+      ...typeof setup.https === "boolean" ? { https: setup.https } : {},
+      routes: await getRouteViews(setup.entries)
+    });
+  }
+  for (const run of runBySetup.values()) {
+    instances.push(await getRunInstanceView(run));
+  }
+  return instances.sort((left, right) => {
+    if (left.running !== right.running) return left.running ? -1 : 1;
+    return left.projectName.localeCompare(right.projectName);
+  });
+}
+async function getRunInstanceView(run, setup) {
   return {
-    ...run,
-    routes: run.entries.map((entry) => ({
-      host: entry.host,
-      port: entry.port,
-      target: `127.0.0.1:${entry.port}`,
-      listening: portStatus.get(entry.port) ?? false
-    }))
+    id: setup?.id ?? run.id,
+    cwd: run.cwd,
+    projectName: run.projectName,
+    running: true,
+    mode: run.mode,
+    updatedAt: setup?.updatedAt ?? run.updatedAt,
+    startedAt: run.startedAt,
+    pid: run.pid,
+    ...run.caddyPid ? { caddyPid: run.caddyPid } : {},
+    ...run.childPid ? { childPid: run.childPid } : {},
+    ...run.childCommand ? { childCommand: run.childCommand } : {},
+    ...run.configPath ? { configPath: run.configPath } : {},
+    ...run.caddyfilePath ? { caddyfilePath: run.caddyfilePath } : {},
+    ...typeof run.https === "boolean" ? { https: run.https } : {},
+    routes: await getRouteViews(run.entries)
   };
 }
-function formatRunViews(runs) {
-  if (runs.length === 0) return "No Localghost apps are running.";
+function formatInstanceViews(instances) {
+  if (instances.length === 0) return "No Localghost setups found.";
   const lines = ["localghost ps"];
-  for (const run of runs) {
-    const command = run.childCommand?.length ? ` ${run.childCommand.join(" ")}` : "";
-    const mode = command ? `${run.mode}:${command}` : run.mode;
+  for (const instance of instances) {
+    const command = instance.childCommand?.length ? ` ${instance.childCommand.join(" ")}` : "";
+    const mode = command ? `${instance.mode}:${command}` : instance.mode === "setup" ? "" : instance.mode;
     lines.push("");
-    lines.push(`${run.projectName}  ${mode}`);
-    lines.push(`  cwd: ${run.cwd}`);
-    lines.push(`  pid: ${run.pid}${run.caddyPid ? `, caddy: ${run.caddyPid}` : ""}${run.childPid ? `, child: ${run.childPid}` : ""}`);
-    lines.push(`  started: ${run.startedAt}`);
-    for (const route of run.routes) {
+    lines.push(`${instance.projectName}  ${instance.running ? "running" : "setup"}${mode ? `  ${mode}` : ""}`);
+    lines.push(`  cwd: ${instance.cwd}`);
+    if (instance.pid) {
+      lines.push(`  pid: ${instance.pid}${instance.caddyPid ? `, caddy: ${instance.caddyPid}` : ""}${instance.childPid ? `, child: ${instance.childPid}` : ""}`);
+    }
+    if (instance.startedAt) lines.push(`  started: ${instance.startedAt}`);
+    if (!instance.startedAt && instance.updatedAt) lines.push(`  setup: ${instance.updatedAt}`);
+    for (const route of instance.routes) {
       lines.push(`  ${route.host} -> ${route.target} (${route.listening ? "listening" : "not listening"})`);
     }
   }
@@ -1074,13 +1626,13 @@ program.command("update").description("Check npm for a newer localghost release"
 program.command("setup").description("Update /etc/hosts and generate/validate Caddyfile").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Generate a local HTTPS Caddy proxy with Caddy local certificates").option("--ssl", "Alias for --https").action(async (options) => {
   assertLocalDevelopment("setup");
   await assertCaddyReady();
-  const https = useHttps(options);
-  const projectName = sanitizeProjectName(options.project ?? getProjectName(options.cwd));
-  const readOptions = readOptionsFromCli(options);
-  const configPath = resolveDevHostsPath(readOptions).path;
-  const entries = readDevHosts(readOptions);
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  const https = context.https;
+  const projectName = context.projectName;
+  const configPath = context.configPath;
+  const entries = context.entries;
   warnAboutLocalMdns(entries);
-  logDomainRoutes(entries, { https });
+  logDomainRoutes(entries, { https, ghostTunnel: context.ghostTunnel });
   explainHostsPassword();
   const hostsResult = await updateSystemHosts(projectName, entries);
   if (hostsResult.changed) {
@@ -1100,6 +1652,15 @@ program.command("setup").description("Update /etc/hosts and generate/validate Ca
     ...hostsResult.tempPath ? { hostsTempPath: hostsResult.tempPath } : {},
     caddyfilePath: caddyfile,
     caddyHttps: https,
+    ...existingTrustMarkers(options.cwd),
+    entries
+  });
+  registerLocalghostSetup({
+    cwd: options.cwd,
+    projectName,
+    configPath,
+    caddyfilePath: caddyfile,
+    https,
     entries
   });
   console.log(`Generated ${caddyfile}`);
@@ -1107,6 +1668,20 @@ program.command("setup").description("Update /etc/hosts and generate/validate Ca
   console.log(`State ${statePath}`);
   console.log("Setup complete.");
 });
+program.command("trust").description("Trust Caddy's local HTTPS CA for this project's HTTPS proxy").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Use HTTPS mode for the Caddyfile").option("--ssl", "Alias for --https").action(async (options) => {
+  assertLocalDevelopment("trust");
+  await assertCaddyReady();
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  if (!context.https) {
+    throw new Error("Localghost HTTPS is not enabled for this context. Set https: true in localghost.config.mjs or pass --https.");
+  }
+  warnAboutLocalMdns(context.entries);
+  logDomainRoutes(context.entries, { https: true, ghostTunnel: context.ghostTunnel });
+  explainTrustPassword();
+  const caddyfile = await writeCaddyfile(context.entries, options.cwd, { https: true });
+  await validateCaddyfile(caddyfile);
+  await runTrust(options.cwd, caddyfile);
+});
 program.command("reset").description("Remove Localghost setup state without deleting .localghost").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).action(async (options) => {
   assertLocalDevelopment("reset");
   const projectName = sanitizeProjectName(options.project ?? getProjectName(options.cwd));
@@ -1114,13 +1689,13 @@ program.command("reset").description("Remove Localghost setup state without dele
   const statePath = getLocalghostStatePath(options.cwd);
   explainHostsPassword();
   const hostsResult = await removeSystemHosts(projectName);
-  if (existsSync6(caddyfilePath)) {
+  if (existsSync7(caddyfilePath)) {
     unlinkSync(caddyfilePath);
     console.log(`Removed ${caddyfilePath}`);
   } else {
     console.log(`${caddyfilePath} was not present`);
   }
-  if (existsSync6(statePath)) {
+  if (existsSync7(statePath)) {
     unlinkSync(statePath);
     console.log(`Removed ${statePath}`);
   } else {
@@ -1131,6 +1706,7 @@ program.command("reset").description("Remove Localghost setup state without dele
   } else {
     console.log(`No Localghost hosts block found in ${hostsResult.hostsPath}`);
   }
+  unregisterLocalghostSetup({ cwd: options.cwd, projectName });
   console.log(".localghost was left in place. Run localghost setup when you are ready.");
 });
 program.command("teardown").description("Remove Localghost's managed /etc/hosts block").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--remove-caddyfile", "Also remove ops/local/Caddyfile").action(async (options) => {
@@ -1140,7 +1716,7 @@ program.command("teardown").description("Remove Localghost's managed /etc/hosts
   const hostsResult = await removeSystemHosts(projectName);
   const caddyfilePath = getCaddyfilePath(options.cwd);
   let caddyfileRemoved = false;
-  if (options.removeCaddyfile && existsSync6(caddyfilePath)) {
+  if (options.removeCaddyfile && existsSync7(caddyfilePath)) {
     unlinkSync(caddyfilePath);
     caddyfileRemoved = true;
   }
@@ -1162,12 +1738,20 @@ program.command("teardown").description("Remove Localghost's managed /etc/hosts
   if (options.removeCaddyfile) {
     console.log(caddyfileRemoved ? `Removed ${caddyfilePath}` : `${caddyfilePath} was not present`);
   }
+  unregisterLocalghostSetup({ cwd: options.cwd, projectName });
   console.log(`State ${statePath}`);
 });
-program.command("status").description("Print Localghost's project-local state file").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--ready", "Exit non-zero when setup is missing or stale").option("--https", "Check setup readiness for HTTPS mode").option("--ssl", "Alias for --https").option("--json", "Print raw JSON").action((options) => {
+program.command("status").description("Print Localghost's project-local state file").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--ready", "Exit non-zero when setup is missing or stale").option("--https", "Check setup readiness for HTTPS mode").option("--ssl", "Alias for --https").option("--json", "Print raw JSON").action(async (options) => {
   const state = readLocalghostState(options.cwd);
   const statePath = getLocalghostStatePath(options.cwd);
-  const readiness = getSetupReadiness({ ...options, https: useHttps(options) });
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  const readiness = getSetupReadiness({
+    ...options,
+    https: context.https,
+    entries: context.entries,
+    configPath: context.configPath,
+    projectName: context.projectName
+  });
   if (options.json) {
     console.log(JSON.stringify({ state, setup: readiness }, null, 2));
     return;
@@ -1183,6 +1767,8 @@ program.command("status").description("Print Localghost's project-local state fi
     if (state.hostsPath) console.log(`Hosts: ${state.hostsPath}`);
     if (state.caddyfilePath) console.log(`Caddyfile: ${state.caddyfilePath}`);
     if (typeof state.caddyHttps === "boolean") console.log(`Mode: ${state.caddyHttps ? "HTTPS" : "HTTP"}`);
+    if (state.caddyTrustedAt) console.log(`HTTPS trust: yes (${state.caddyTrustedAt})`);
+    if (!state.caddyTrustedAt && state.caddyTrustPromptedAt) console.log(`HTTPS trust: not enabled (asked ${state.caddyTrustPromptedAt})`);
     if (typeof state.caddyfileRemoved === "boolean") console.log(`Caddyfile removed: ${state.caddyfileRemoved}`);
   }
   if (readiness.ready) {
@@ -1198,16 +1784,30 @@ program.command("status").description("Print Localghost's project-local state fi
     process.exitCode = 1;
   }
 });
-program.command("routes").description("Print domain to upstream routes").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--http", "Print domain URLs with http instead of https").option("--https", "Print domain URLs with https").option("--ssl", "Alias for --https").action((options) => {
-  const entries = readDevHosts(readOptionsFromCli(options));
-  warnAboutLocalMdns(entries);
-  console.log(formatDomainRoutes(entries, { https: options.http ? false : useHttps(options) }));
+program.command("routes").description("Print domain to upstream routes").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--http", "Print domain URLs with http instead of https").option("--https", "Print domain URLs with https").option("--ssl", "Alias for --https").option("--verbose", "Print Ghost Tunnel mode, domains, and guardrails").action(async (options) => {
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  warnAboutLocalMdns(context.entries);
+  console.log(formatDomainRoutes(context.entries, { https: options.http ? false : context.https }));
+  if (context.ghostTunnel.enabled) {
+    console.log(formatGhostTunnel(context.ghostTunnel, {
+      color: shouldColor(),
+      label: "expected",
+      verbose: options.verbose === true
+    }));
+  }
 });
-program.command("dev").description("Run the Localghost Caddy proxy after setup").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting the proxy when setup is missing or stale").action(async (options) => {
+program.command("dev").description("Run the Localghost Caddy proxy after setup").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting the proxy when setup is missing or stale").option("--trust", "Trust Caddy's local HTTPS CA before starting the proxy").action(async (options) => {
   assertLocalDevelopment("dev");
   await assertCaddyReady();
-  const https = useHttps(options);
-  const readiness = getSetupReadiness({ ...options, https });
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  const https = context.https;
+  const readiness = getSetupReadiness({
+    ...options,
+    https,
+    entries: context.entries,
+    configPath: context.configPath,
+    projectName: context.projectName
+  });
   if (!readiness.ready) {
     if (!options.setup) {
       throw new Error(
@@ -1233,14 +1833,34 @@ program.command("dev").description("Run the Localghost Caddy proxy after setup")
       ...hostsResult.tempPath ? { hostsTempPath: hostsResult.tempPath } : {},
       caddyfilePath,
       caddyHttps: https,
+      ...existingTrustMarkers(options.cwd),
+      entries: readiness.entries
+    });
+    registerLocalghostSetup({
+      cwd: options.cwd,
+      projectName: readiness.projectName,
+      configPath: readiness.configPath,
+      caddyfilePath,
+      https,
       entries: readiness.entries
     });
   }
   warnAboutLocalMdns(readiness.entries);
-  logDomainRoutes(readiness.entries, { https });
+  logDomainRoutes(readiness.entries, { https, ghostTunnel: context.ghostTunnel });
   const caddyfile = await writeCaddyfile(readiness.entries, options.cwd, { https });
   await validateCaddyfile(caddyfile);
   const caddy = startCaddy(caddyfile);
+  try {
+    await maybeTrustCaddy({
+      cwd: options.cwd,
+      https,
+      caddyfilePath: caddyfile,
+      ...typeof options.trust === "boolean" ? { trust: options.trust } : {}
+    });
+  } catch (error) {
+    if (!caddy.killed) caddy.kill("SIGINT");
+    throw error;
+  }
   const caddyPid = maybePid(caddy.pid);
   const runRecord = registerLocalghostRun({
     mode: "dev",
@@ -1259,20 +1879,27 @@ program.command("dev").description("Run the Localghost Caddy proxy after setup")
     cleanupRun();
   }
 });
-program.command("run").description("Run Caddy and a dev command from the same Localghost context").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--port <number>", "Initial app port", parsePort2).option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting when setup is missing or stale").option("--dynamic-port [yes|no]", "Use the requested port if free, otherwise continue upward", parseBooleanLike, false).argument("<command...>", "Command to run after --, for example: localghost run -- vite").action(async (command, options) => {
+program.command("run").description("Run Caddy and a dev command from the same Localghost context").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--port <number>", "Initial app port", parsePort2).option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting when setup is missing or stale").option("--trust", "Trust Caddy's local HTTPS CA before starting the child command").option("--dynamic-port [yes|no]", "Use the requested port if free, otherwise continue upward", parseBooleanLike).argument("<command...>", "Command to run after --, for example: localghost run -- vite").action(async (command, options) => {
   assertLocalDevelopment("run");
   await assertCaddyReady();
-  const https = useHttps(options);
   const context = await resolveLocalghostContext({
     cwd: options.cwd,
     ...options.project ? { project: options.project } : {},
     ...options.config && options.config.length > 0 ? { configFiles: options.config } : {},
     ...options.configPattern ? { configPattern: options.configPattern } : {},
     ...options.port ? { port: options.port } : {},
-    https,
+    ...useHttps(options) ? { https: true } : {},
     ...typeof options.dynamicPort === "boolean" ? { dynamicPort: options.dynamicPort } : {}
   });
-  const readiness = getSetupReadiness({ ...options, https, ignoreCaddyfile: true });
+  const https = context.https;
+  const readiness = getSetupReadiness({
+    ...options,
+    https,
+    ignoreCaddyfile: true,
+    entries: context.entries,
+    configPath: context.configPath,
+    projectName: context.projectName
+  });
   if (!readiness.ready) {
     const shouldSetup = options.setup === true || canPrompt() && await confirm("Run caddy:setup now?", true);
     if (!shouldSetup) {
@@ -1291,13 +1918,24 @@ program.command("run").description("Run Caddy and a dev command from the same Lo
     console.log(`Port ${context.requestedPort} is busy; using ${context.port}.`);
   }
   warnAboutLocalMdns(context.entries);
-  logDomainRoutes(context.entries, { https });
+  logDomainRoutes(context.entries, { https, ghostTunnel: context.ghostTunnel });
   const caddyfile = await writeCaddyfile(context.entries, options.cwd, { https });
   await validateCaddyfile(caddyfile);
   const caddy = startCaddy(caddyfile);
   const caddyExit = caddy.catch((error) => {
     if (!caddy.killed) throw error;
   });
+  try {
+    await maybeTrustCaddy({
+      cwd: options.cwd,
+      https,
+      caddyfilePath: caddyfile,
+      ...typeof options.trust === "boolean" ? { trust: options.trust } : {}
+    });
+  } catch (error) {
+    if (!caddy.killed) caddy.kill("SIGINT");
+    throw error;
+  }
   const [binary, ...args] = command;
   if (!binary) {
     throw new Error("Missing command. Use: localghost run -- vite");
@@ -1345,13 +1983,15 @@ program.command("run").description("Run Caddy and a dev command from the same Lo
     cleanupRun();
   }
 });
-program.command("ps").description("Show Localghost dev sessions that are currently running").option("--json", "Print raw JSON").action(async (options) => {
-  const runs = await Promise.all(listLocalghostRuns().map((run) => getRunView(run)));
+program.command("ps").description("Show Localghost setups and currently running sessions").option("--json", "Print raw JSON").action(async (options) => {
+  const setups = listLocalghostSetups();
+  const runs = listLocalghostRuns();
+  const instances = await getInstanceViews(setups, runs);
   if (options.json) {
-    console.log(JSON.stringify({ activityPath: getLocalghostActivityPath(), runs }, null, 2));
+    console.log(JSON.stringify({ activityPath: getLocalghostActivityPath(), setups, runs, instances }, null, 2));
     return;
   }
-  console.log(formatRunViews(runs));
+  console.log(formatInstanceViews(instances));
 });
 program.command("print").description("Print parsed host config").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").action((options) => {
   const entries = readDevHosts(readOptionsFromCli(options));