@hamedb89/localghost 0.1.9 → 0.1.12

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, unlinkSync } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8, unlinkSync } from "fs";
 import { Command, InvalidArgumentError } from "commander";
 
 // src/activity.ts
@@ -254,6 +254,17 @@ function sanitizeProjectName(value) {
   return projectName || "app";
 }
 
+// src/brand.ts
+function renderLocalghostBanner() {
+  return [
+    "   .-.",
+    "  (o o)   LOCALGHOST",
+    "  | O \\   friendly local domains",
+    "   \\   \\",
+    "    `~~~'"
+  ].join("\n");
+}
+
 // src/caddy.ts
 import { dirname as dirname3, join as join3 } from "path";
 import { execa } from "execa";
@@ -271,6 +282,12 @@ function writeTextFile(path, value) {
 }
 
 // src/caddy.ts
+function shouldShowCaddyLogs() {
+  return ["1", "true", "yes", "on"].includes((process.env.LOCALGHOST_CADDY_VERBOSE ?? "").toLowerCase());
+}
+function caddyStdio() {
+  return shouldShowCaddyLogs() ? "inherit" : "pipe";
+}
 function groupByPort(entries) {
   const groups = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -289,7 +306,7 @@ function renderCaddyfile(entries, options = {}) {
   const blocks = [...groups.entries()].sort(([leftPort], [rightPort]) => leftPort - rightPort).map(([port, group]) => {
     const hosts = group.map((entry) => https ? entry.host : `http://${entry.host}`).sort().join(", ");
     return `${hosts} {
-  reverse_proxy 127.0.0.1:${port}
+	reverse_proxy 127.0.0.1:${port}
 }`;
   });
   const globalOptions = https ? `{
@@ -308,13 +325,13 @@ async function writeCaddyfile(entries, cwd = process.cwd(), options = {}) {
 async function validateCaddyfile(path) {
   await execa("caddy", ["validate", "--config", path], {
     cwd: dirname3(path),
-    stdio: "inherit"
+    stdio: caddyStdio()
   });
 }
 function startCaddy(path) {
   return execa("caddy", ["run", "--config", path], {
     cwd: dirname3(path),
-    stdio: "inherit"
+    stdio: caddyStdio()
   });
 }
 async function trustCaddy(path) {
@@ -324,21 +341,132 @@ async function trustCaddy(path) {
   });
 }
 
-// src/context.ts
+// src/command.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { isAbsolute, join as join4, relative, resolve as resolve2 } from "path";
+function readPackageJson(cwd) {
+  const path = join4(cwd, "package.json");
+  if (!existsSync3(path)) {
+    throw new Error(`No package.json found in ${cwd}. Pass an explicit command with \`localghost run -- <command>\`.`);
+  }
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    throw new Error(`Could not parse ${path}.`);
+  }
+}
+function detectDevPackageManager(cwd, packageManager) {
+  if (typeof packageManager === "string") {
+    const name = packageManager.split("@")[0];
+    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
+  }
+  if (existsSync3(join4(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync3(join4(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync3(join4(cwd, "bun.lock")) || existsSync3(join4(cwd, "bun.lockb"))) return "bun";
+  return "npm";
+}
+function scriptCommand(packageManager, script) {
+  if (packageManager === "yarn") return ["yarn", script];
+  return [packageManager, "run", script];
+}
+function invokesLocalghost(script) {
+  return /(^|[\s;&|])(?:npm\s+exec\s+|pnpm\s+exec\s+|bunx\s+|npx\s+)?localghost(?:\s|$)/.test(script);
+}
+function detectDevCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  if (options.command) {
+    if (options.command.length === 0 || options.command.some((part) => typeof part !== "string" || part.length === 0)) {
+      throw new Error("localghost.config.mjs command must be a non-empty array of strings.");
+    }
+    if (invokesLocalghost(options.command.join(" "))) {
+      throw new Error("localghost.config.mjs command cannot invoke Localghost recursively.");
+    }
+    return { command: [...options.command], source: "config" };
+  }
+  const pkg = readPackageJson(cwd);
+  const scripts = typeof pkg.scripts === "object" && pkg.scripts ? pkg.scripts : {};
+  const packageManager = detectDevPackageManager(cwd, pkg.packageManager);
+  for (const script of ["dev:raw", "dev"]) {
+    const value = scripts[script];
+    if (typeof value !== "string" || invokesLocalghost(value)) continue;
+    return {
+      command: scriptCommand(packageManager, script),
+      source: "script",
+      packageManager,
+      script
+    };
+  }
+  throw new Error([
+    `Could not detect a safe development command in ${join4(cwd, "package.json")}.`,
+    "Add a non-recursive dev or dev:raw script, configure command in localghost.config.mjs,",
+    "or pass an explicit command with `localghost run -- <command>`."
+  ].join(" "));
+}
+function formatDetectedDevCommand(detected) {
+  const command = detected.command.map((part) => /^[A-Za-z0-9_./:@=-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+  const source = detected.source === "config" ? "localghost.config.mjs" : `package.json#scripts.${detected.script}`;
+  return `${command} (${source})`;
+}
+function assertServicePath(root, serviceCwd, name) {
+  const cwd = resolve2(root, serviceCwd);
+  const relativeCwd = relative(root, cwd);
+  if (isAbsolute(relativeCwd) || relativeCwd === ".." || relativeCwd.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+    throw new Error(`Service ${name} cwd must stay inside the project root.`);
+  }
+  return { cwd, relativeCwd: relativeCwd || "." };
+}
+function detectDevServices(options) {
+  const root = options.cwd ?? process.cwd();
+  if (options.services.length === 0) throw new Error("services must contain at least one service.");
+  const names = /* @__PURE__ */ new Set();
+  const hosts = /* @__PURE__ */ new Set();
+  return options.services.map((service, index) => {
+    if (!service || typeof service !== "object") throw new Error(`Service at index ${index} must be an object.`);
+    if (!service.name || names.has(service.name)) throw new Error(`Service name must be unique: ${service.name || `<index ${index}>`}.`);
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(service.name)) throw new Error(`Invalid service name: ${service.name}.`);
+    if (!service.host || hosts.has(service.host)) throw new Error(`Service host must be unique: ${service.host || `<index ${index}>`}.`);
+    if (!Number.isInteger(service.port) || service.port < 1 || service.port > 65535) {
+      throw new Error(`Invalid port for service ${service.name}: ${service.port}.`);
+    }
+    names.add(service.name);
+    hosts.add(service.host);
+    const path = assertServicePath(root, service.cwd, service.name);
+    const detected = detectDevCommand({
+      cwd: path.cwd,
+      ...service.command ? { command: service.command } : {}
+    });
+    return {
+      name: service.name,
+      ...path,
+      host: service.host,
+      requestedPort: service.port,
+      command: detected.command,
+      commandSource: detected.source
+    };
+  });
+}
+function formatDetectedDevServices(services) {
+  return [
+    `Localghost detected ${services.length} services:`,
+    ...services.map((service) => `${service.name}: ${service.command.map((part) => /^[A-Za-z0-9_./:@=-]+$/.test(part) ? part : JSON.stringify(part)).join(" ")} (${service.relativeCwd}, ${service.host} -> ${service.requestedPort})`)
+  ].join("\n");
+}
+
+// src/context.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 import { pathToFileURL } from "url";
 
 // src/port.ts
 import { createServer } from "net";
 async function isPortAvailable(port, host = "127.0.0.1") {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const server = createServer();
     server.once("error", () => {
-      resolve2(false);
+      resolve3(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve2(true));
+      server.close(() => resolve3(true));
     });
     server.listen(port, host);
   });
@@ -361,6 +489,17 @@ var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
 var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
 var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
 var DEFAULT_GHOST_TUNNEL_MODE = "manual";
+var DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY = "same-project";
+var DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND = "none";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER = "vercel-redis";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV = "auto";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE = "localghost";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS = 25e3;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS = 250;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS = 30;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS = 60;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES = 5 * 1024 * 1024;
 function isResolvedGhostTunnelConfig(value) {
   return typeof value === "object" && value !== null && "enabled" in value;
 }
@@ -410,6 +549,86 @@ function normalizeDomains(domains) {
 function parseGhostTunnelMode(value) {
   return value ?? DEFAULT_GHOST_TUNNEL_MODE;
 }
+function parseGhostTunnelAdapterStrategy(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY;
+  if (value === "same-project" || value === "separate-relay") return value;
+  throw new Error(`Unsupported ghost tunnel adapter strategy: ${String(value)}`);
+}
+function parseGhostTunnelTransportKind(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND;
+  if (value === "none" || value === "ip" || value === "tunnel") return value;
+  throw new Error(`Unsupported ghost tunnel transport: ${String(value)}`);
+}
+function parsePositiveInteger(value, fallback, name) {
+  if (typeof value === "undefined") return fallback;
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error(`Invalid ghost tunnel ${name}: ${value}`);
+  }
+  return value;
+}
+function parseTunnelStoreProvider(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER;
+  if (value === "vercel-redis" || value === "redis") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store provider: ${String(value)}`);
+}
+function parseTunnelStoreEnv(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV;
+  if (value === "auto") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store env: ${String(value)}`);
+}
+function parseTunnelStoreNamespace(value) {
+  const namespace = value ?? DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE;
+  if (!/^[a-z][a-z0-9:_-]{0,63}$/i.test(namespace)) {
+    throw new Error(`Invalid ghost tunnel tunnel store namespace: ${namespace}`);
+  }
+  return namespace;
+}
+function resolveGhostTunnelAdapter(input2) {
+  if (!input2) return void 0;
+  const provider = typeof input2 === "string" ? input2 : input2.provider;
+  if (provider !== "vercel") {
+    throw new Error(`Unsupported ghost tunnel adapter provider: ${String(provider)}`);
+  }
+  return {
+    provider,
+    strategy: typeof input2 === "string" ? DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY : parseGhostTunnelAdapterStrategy(input2.strategy)
+  };
+}
+function getLegacyGhostTunnelTransport(input2) {
+  if (!input2 || typeof input2 === "string" || !("transport" in input2)) return void 0;
+  return input2.transport;
+}
+function resolveGhostTunnelTransport(input2) {
+  if (!input2) {
+    return { kind: "none" };
+  }
+  const kind = typeof input2 === "string" ? parseGhostTunnelTransportKind(input2) : parseGhostTunnelTransportKind(input2.kind);
+  if (kind === "ip") {
+    return {
+      kind,
+      allowPrivateNetworkAddress: typeof input2 === "string" ? false : input2.kind === "ip" ? input2.allowPrivateNetworkAddress ?? false : false
+    };
+  }
+  if (kind === "tunnel") {
+    const config = typeof input2 === "string" || input2.kind !== "tunnel" ? void 0 : input2;
+    const store = config?.store ?? {};
+    return {
+      kind,
+      store: {
+        provider: parseTunnelStoreProvider(store.provider),
+        env: parseTunnelStoreEnv(store.env),
+        namespace: parseTunnelStoreNamespace(store.namespace)
+      },
+      waitMs: parsePositiveInteger(config?.waitMs, DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS, "tunnel waitMs"),
+      pollIntervalMs: parsePositiveInteger(config?.pollIntervalMs, DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS, "tunnel pollIntervalMs"),
+      routeTtlSeconds: parsePositiveInteger(config?.routeTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS, "tunnel routeTtlSeconds"),
+      requestTtlSeconds: parsePositiveInteger(config?.requestTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS, "tunnel requestTtlSeconds"),
+      maxRequestBodyBytes: parsePositiveInteger(config?.maxRequestBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES, "tunnel maxRequestBodyBytes"),
+      maxResponseBodyBytes: parsePositiveInteger(config?.maxResponseBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES, "tunnel maxResponseBodyBytes")
+    };
+  }
+  return { kind: "none" };
+}
 function resolveNamespaceConfig(options) {
   const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
   let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
@@ -495,8 +714,11 @@ function getDisplayValues(input2) {
     ...input2.values
   };
 }
+function getDisplayDefaults(defaults) {
+  return defaults;
+}
 function createDisplayUrl(config, defaults, domain) {
-  const input2 = getPreviewDefaults(config.preview, defaults);
+  const input2 = getPreviewDefaults(config.preview, getDisplayDefaults(defaults));
   const protocol = input2.protocol ?? "https";
   const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input2));
   const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input2.domain ? getGhostTunnelEntryHost(input2.domain, config) : `${config.subdomain}.*`;
@@ -505,8 +727,9 @@ function createDisplayUrl(config, defaults, domain) {
   return `${url}${input2.path.replace(/^\/+/, "")}`;
 }
 function createDisplayUrls(config, defaults) {
-  const domains = config.domains.length > 0 ? config.domains : defaults?.domain ? [defaults.domain] : [];
-  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, defaults, domain)) : [createDisplayUrl(config, defaults)];
+  const displayDefaults = getDisplayDefaults(defaults);
+  const domains = config.domains.length > 0 ? config.domains : displayDefaults?.domain ? [displayDefaults.domain] : [];
+  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, displayDefaults, domain)) : [createDisplayUrl(config, displayDefaults)];
   return [...new Set(urls)];
 }
 function maybeConstructPreviewUrl(config, defaults) {
@@ -534,7 +757,8 @@ function resolveGhostTunnelConfig(options, defaults) {
       namespace: resolveNamespaceConfig(void 0),
       displayUrls: [],
       requireHttps: true,
-      requireAuth: true
+      requireAuth: true,
+      transport: resolveGhostTunnelTransport(void 0)
     };
   }
   const config = typeof options === "string" ? { mode: options } : options;
@@ -542,6 +766,8 @@ function resolveGhostTunnelConfig(options, defaults) {
   assertValidSubdomain(subdomain);
   const domains = normalizeDomains(config.domains);
   const enabled = config.enabled ?? true;
+  const adapter = resolveGhostTunnelAdapter(config.adapter);
+  const transport = resolveGhostTunnelTransport(config.transport ?? getLegacyGhostTunnelTransport(config.adapter));
   const resolved = {
     enabled,
     mode: parseGhostTunnelMode(config.mode),
@@ -551,7 +777,9 @@ function resolveGhostTunnelConfig(options, defaults) {
     ...config.preview ? { preview: config.preview } : {},
     displayUrls: [],
     requireHttps: config.requireHttps ?? true,
-    requireAuth: config.requireAuth ?? true
+    requireAuth: config.requireAuth ?? true,
+    transport,
+    ...adapter ? { adapter } : {}
   };
   if (!enabled) {
     return resolved;
@@ -632,7 +860,7 @@ function envHttps() {
 }
 function getPackageName(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync4(join4(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync5(join5(cwd, "package.json"), "utf8"));
     return typeof pkg.name === "string" ? pkg.name : void 0;
   } catch {
     return void 0;
@@ -661,7 +889,7 @@ function withRuntimePort(entries, requestedPort, port) {
   if (requestedPort === port) return entries;
   const hasRequestedPort = entries.some((entry) => entry.port === requestedPort);
   if (!hasRequestedPort) return entries;
-  return entries.map((entry) => entry.port === requestedPort ? { ...entry, port } : entry);
+  return entries.map((entry) => entry.port === requestedPort ? { ...entry, port, target: `127.0.0.1:${port}` } : entry);
 }
 function uniqueHosts(entries) {
   return [...new Set(entries.map((entry) => entry.host))];
@@ -691,7 +919,7 @@ async function readLocalghostProjectConfig(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   if (options.configFile === false) return { config: {} };
   const candidates = options.configFile ? [options.configFile] : LOCALGHOST_PROJECT_CONFIG_FILES;
-  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync3(candidate));
+  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync4(candidate));
   if (!path) return { config: {} };
   const imported = await import(`${pathToFileURL(path).href}?localghost=${Date.now()}`);
   const config = imported.default ?? imported;
@@ -712,6 +940,7 @@ async function resolveLocalghostContext(options = {}) {
   const configEntries = readDevHosts(readOptions);
   const requestedPort = merged.port ?? envPort() ?? configEntries[0]?.port ?? 5173;
   const dynamicPort = merged.dynamicPort ?? envDynamicPort() ?? true;
+  const autoRepair = merged.autoRepair ?? true;
   const bindHost = merged.bindHost ?? "127.0.0.1";
   const probeHost = typeof bindHost === "string" ? bindHost : "127.0.0.1";
   const port = dynamicPort ? await findAvailablePort(requestedPort, { host: probeHost }) : requestedPort;
@@ -737,6 +966,7 @@ async function resolveLocalghostContext(options = {}) {
     requestedPort,
     port,
     dynamicPort,
+    autoRepair,
     bindHost,
     primaryHost,
     https: merged.https ?? envHttps() ?? false,
@@ -789,10 +1019,418 @@ function assertLocalDevelopment(command, env = process.env) {
   throw new Error(`Localghost only runs in local development. Refusing \`${command}\` because ${reason}.`);
 }
 
+// src/ghost-file.ts
+var LOCALGHOST_GHOST_TUNNEL_FILE = ".ghosttunnel";
+function toGhostTunnelOptions(options = {}) {
+  const resolved = typeof options === "string" ? { cwd: options } : options;
+  return {
+    ...resolved,
+    fileName: resolved.fileName ?? LOCALGHOST_GHOST_TUNNEL_FILE
+  };
+}
+function resolveGhostTunnelPath(options = {}) {
+  return resolveDevHostsPath(toGhostTunnelOptions(options));
+}
+function readGhostTunnelEntries(options = {}) {
+  return readDevHosts(toGhostTunnelOptions(options));
+}
+function listGhostTunnelEntries(options = {}) {
+  const resolved = resolveGhostTunnelPath(options);
+  if (!resolved.exists) return [];
+  return readGhostTunnelEntries(options);
+}
+
+// src/ghost-agent.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/relay.ts
+import { createHmac, timingSafeEqual } from "crypto";
+import { domainToASCII as domainToASCII2 } from "url";
+var DEFAULT_RELAY_ALLOWED_TARGET_HOSTS = ["localhost", "127.0.0.1", "::1"];
+var DEFAULT_RELAY_BLOCKED_PORTS = [22, 2375, 2376, 5432, 6379, 9200, 9229, 27017];
+var DEFAULT_RELAY_LIMITS = {
+  requestBodyBytes: 5 * 1024 * 1024,
+  responseBytes: 25 * 1024 * 1024,
+  timeoutMs: 3e4,
+  maxConcurrentRequests: 20,
+  perRouteRequestsPerMinute: 120,
+  perIpRequestsPerMinute: 60
+};
+var DEFAULT_RELAY_TARGET_POLICY = {
+  allowedHosts: [...DEFAULT_RELAY_ALLOWED_TARGET_HOSTS],
+  blockedPorts: [...DEFAULT_RELAY_BLOCKED_PORTS],
+  allowPrivateNetworkTargets: false
+};
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var HOST_PATTERN2 = /^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*$/i;
+var IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+function normalizeHost(host) {
+  const trimmed = host.trim().toLowerCase().replace(/\.$/, "");
+  if (!trimmed || trimmed.includes("*") || trimmed.includes("/") || trimmed.includes(":")) return null;
+  const ascii = domainToASCII2(trimmed);
+  if (!ascii || ascii.includes("..")) return null;
+  return HOST_PATTERN2.test(ascii) ? ascii : null;
+}
+function normalizeTargetHost(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed === "::1" || trimmed === "[::1]") return "::1";
+  if (trimmed.includes("/") || trimmed.includes("*")) return null;
+  if (IPV4_PATTERN.test(trimmed)) return isValidIpv4(trimmed) ? trimmed : null;
+  return normalizeHost(trimmed);
+}
+function isValidIpv4(value) {
+  return value.split(".").every((part) => {
+    const octet = Number(part);
+    return Number.isInteger(octet) && octet >= 0 && octet <= 255 && String(octet) === part;
+  });
+}
+function isPrivateIpv4(value) {
+  if (!isValidIpv4(value)) return false;
+  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
+  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
+}
+function isLocalTargetHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function mergeTargetPolicy(policy) {
+  return {
+    allowedHosts: policy?.allowedHosts ?? DEFAULT_RELAY_TARGET_POLICY.allowedHosts,
+    blockedPorts: policy?.blockedPorts ?? DEFAULT_RELAY_TARGET_POLICY.blockedPorts,
+    allowPrivateNetworkTargets: policy?.allowPrivateNetworkTargets ?? DEFAULT_RELAY_TARGET_POLICY.allowPrivateNetworkTargets
+  };
+}
+function assertRelayLocalTarget(target, policyInput) {
+  if (!target || typeof target !== "object") {
+    throw new Error("Relay target must be an explicit local target object.");
+  }
+  const policy = mergeTargetPolicy(policyInput);
+  const host = normalizeTargetHost(target.host);
+  if (!host) {
+    throw new Error(`Invalid relay target host: ${target.host}`);
+  }
+  if (!Number.isInteger(target.port) || target.port < 1 || target.port > 65535) {
+    throw new Error(`Invalid relay target port: ${target.port}`);
+  }
+  const protocol = target.protocol ?? "http";
+  if (protocol !== "http" && protocol !== "https") {
+    throw new Error(`Invalid relay target protocol: ${String(protocol)}`);
+  }
+  if (policy.blockedPorts.includes(target.port)) {
+    throw new Error(`Relay target port is blocked: ${target.port}`);
+  }
+  const allowedHosts = new Set(policy.allowedHosts.map((allowedHost) => normalizeTargetHost(allowedHost)).filter((value) => Boolean(value)));
+  if (!allowedHosts.has(host)) {
+    throw new Error(`Relay target host is not explicitly allowed: ${host}`);
+  }
+  if (!policy.allowPrivateNetworkTargets && !isLocalTargetHost(host) && (host === "::1" || isPrivateIpv4(host))) {
+    throw new Error(`Private-network relay target requires explicit opt-in: ${host}`);
+  }
+  return {
+    protocol,
+    host,
+    port: target.port
+  };
+}
+function stripRelayForwardHeaders(headers) {
+  const stripped = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "undefined") continue;
+    const lowerName = name.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lowerName)) continue;
+    if (lowerName.startsWith("x-localghost-")) continue;
+    stripped[name] = value;
+  }
+  return stripped;
+}
+
+// src/ghost-tunnel-store.ts
+import { randomUUID } from "crypto";
+function base64Encode(value) {
+  return value.toString("base64");
+}
+function encodeGhostTunnelBody(value) {
+  return base64Encode(Buffer.isBuffer(value) ? value : Buffer.from(value));
+}
+function decodeGhostTunnelBody(value) {
+  return value ? Buffer.from(value, "base64") : void 0;
+}
+function createGhostTunnelRouteHeartbeat(input2) {
+  const now = input2.now ?? /* @__PURE__ */ new Date();
+  return {
+    host: input2.host,
+    agentId: input2.agentId,
+    target: input2.target,
+    updatedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + input2.ttlSeconds * 1e3).toISOString()
+  };
+}
+function isExpired(expiresAt, now = /* @__PURE__ */ new Date()) {
+  const timestamp = Date.parse(expiresAt);
+  return Number.isNaN(timestamp) || timestamp <= now.getTime();
+}
+function serializeJson(value) {
+  return JSON.stringify(value);
+}
+function parseJson(value) {
+  if (typeof value !== "string") return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+function keyPart(value) {
+  return value.toLowerCase().replace(/[^a-z0-9._:-]/g, "_");
+}
+var RedisGhostTunnelStore = class {
+  url;
+  token;
+  namespace;
+  fetchImpl;
+  constructor(options) {
+    this.url = options.url.replace(/\/+$/, "");
+    this.token = options.token;
+    this.namespace = options.namespace ?? "localghost";
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  key(kind, id) {
+    return `${this.namespace}:ghost-tunnel:${kind}:${keyPart(id)}`;
+  }
+  async command(command, ...args) {
+    const response = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${this.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify([command, ...args])
+    });
+    if (!response.ok) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = await response.json();
+    if (payload.error) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${payload.error}`);
+    }
+    return typeof payload.result === "undefined" ? null : payload.result;
+  }
+  async heartbeatRoute(route, ttlSeconds) {
+    await this.command("SET", this.key("route", route.host), serializeJson(route), "EX", ttlSeconds);
+  }
+  async getRoute(host) {
+    const route = parseJson(await this.command("GET", this.key("route", host)));
+    return route && !isExpired(route.expiresAt) ? route : null;
+  }
+  async enqueueRequest(request, ttlSeconds) {
+    const queueKey = this.key("queue", request.host);
+    await this.command("RPUSH", queueKey, serializeJson(request));
+    await this.command("EXPIRE", queueKey, ttlSeconds);
+  }
+  async claimRequest(host) {
+    const queueKey = this.key("queue", host);
+    while (true) {
+      const request = parseJson(await this.command("LPOP", queueKey));
+      if (!request) return null;
+      if (!isExpired(request.expiresAt)) return request;
+    }
+  }
+  async writeResponse(response, ttlSeconds) {
+    await this.command("SET", this.key("response", response.id), serializeJson(response), "EX", ttlSeconds);
+  }
+  async readResponse(requestId) {
+    return parseJson(await this.command("GET", this.key("response", requestId)));
+  }
+  async cleanup(requestId) {
+    await this.command("DEL", this.key("response", requestId));
+  }
+};
+function createRedisGhostTunnelStore(options) {
+  return new RedisGhostTunnelStore(options);
+}
+function resolveRedisGhostTunnelEnv(env = process.env) {
+  const candidates = [
+    env.LOCALGHOST_REDIS_REST_URL && env.LOCALGHOST_REDIS_REST_TOKEN ? { url: env.LOCALGHOST_REDIS_REST_URL, token: env.LOCALGHOST_REDIS_REST_TOKEN, source: "localghost" } : null,
+    env.UPSTASH_REDIS_REST_URL && env.UPSTASH_REDIS_REST_TOKEN ? { url: env.UPSTASH_REDIS_REST_URL, token: env.UPSTASH_REDIS_REST_TOKEN, source: "upstash" } : null,
+    env.KV_REST_API_URL && env.KV_REST_API_TOKEN ? { url: env.KV_REST_API_URL, token: env.KV_REST_API_TOKEN, source: "vercel-kv" } : null,
+    env.REDIS_REST_API_URL && env.REDIS_REST_API_TOKEN ? { url: env.REDIS_REST_API_URL, token: env.REDIS_REST_API_TOKEN, source: "redis" } : null
+  ];
+  const match = candidates.find((candidate) => Boolean(candidate));
+  if (!match) {
+    throw new Error("Ghost Tunnel Redis transport requires REST env vars: UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN, KV_REST_API_URL/KV_REST_API_TOKEN, or LOCALGHOST_REDIS_REST_URL/LOCALGHOST_REDIS_REST_TOKEN.");
+  }
+  return match;
+}
+function createRedisGhostTunnelStoreFromEnv(input2 = {}) {
+  const resolved = resolveRedisGhostTunnelEnv(input2.env);
+  return createRedisGhostTunnelStore({
+    url: resolved.url,
+    token: resolved.token,
+    ...input2.namespace ? { namespace: input2.namespace } : {},
+    ...input2.fetch ? { fetch: input2.fetch } : {}
+  });
+}
+
+// src/ghost-agent.ts
+function isStopped(signal, localSignal) {
+  return localSignal.aborted || signal?.aborted === true;
+}
+function wait(ms, signal, localSignal) {
+  if (isStopped(signal, localSignal)) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const timeout = setTimeout(resolve3, ms);
+    const stop = () => {
+      clearTimeout(timeout);
+      resolve3();
+    };
+    signal?.addEventListener("abort", stop, { once: true });
+    localSignal.addEventListener("abort", stop, { once: true });
+  });
+}
+function toHeaderRecord(headers) {
+  const result = {};
+  headers.forEach((value, name) => {
+    result[name] = value;
+  });
+  return result;
+}
+function hasRequestBody(method) {
+  return method !== "GET" && method !== "HEAD";
+}
+async function serveGhostTunnelLocalRequest(input2) {
+  const fetchImpl = input2.fetch ?? fetch;
+  const localUrl = new URL(`${input2.target.protocol}://${input2.target.host}:${input2.target.port}/`);
+  const requestPath = new URL(input2.request.path, "http://localghost.invalid");
+  localUrl.pathname = requestPath.pathname;
+  localUrl.search = requestPath.search;
+  try {
+    const body = hasRequestBody(input2.request.method) ? decodeGhostTunnelBody(input2.request.bodyBase64) : void 0;
+    const response = await fetchImpl(localUrl, {
+      method: input2.request.method,
+      headers: {
+        ...stripRelayForwardHeaders(input2.request.headers),
+        "x-forwarded-host": input2.request.host,
+        "x-localghost-tunnel": "1"
+      },
+      ...body ? { body } : {}
+    });
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    if (responseBody.byteLength > input2.maxResponseBodyBytes) {
+      throw new Error(`Ghost Tunnel response exceeded ${input2.maxResponseBodyBytes} bytes.`);
+    }
+    return {
+      id: input2.request.id,
+      status: response.status,
+      headers: toHeaderRecord(response.headers),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...responseBody.byteLength > 0 ? { bodyBase64: encodeGhostTunnelBody(responseBody) } : {}
+    };
+  } catch (error) {
+    return {
+      id: input2.request.id,
+      status: 502,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      },
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      error: error instanceof Error ? error.message : String(error),
+      bodyBase64: encodeGhostTunnelBody("Ghost Tunnel local target failed.")
+    };
+  }
+}
+async function heartbeatRoutes(input2) {
+  for (const entry of input2.entries) {
+    const target = assertRelayLocalTarget({ host: input2.targetHost, port: entry.port });
+    await input2.store.heartbeatRoute(createGhostTunnelRouteHeartbeat({
+      host: entry.host,
+      agentId: input2.agentId,
+      target,
+      ttlSeconds: input2.routeTtlSeconds
+    }), input2.routeTtlSeconds);
+  }
+}
+async function claimAndServe(input2) {
+  const request = await input2.store.claimRequest(input2.entry.host);
+  if (!request) return false;
+  const target = assertRelayLocalTarget({ host: input2.targetHost, port: input2.entry.port });
+  const response = await serveGhostTunnelLocalRequest({
+    request,
+    target,
+    maxResponseBodyBytes: input2.maxResponseBodyBytes,
+    ...input2.fetch ? { fetch: input2.fetch } : {}
+  });
+  await input2.store.writeResponse(response, input2.requestTtlSeconds);
+  return true;
+}
+function startGhostTunnelAgent(options) {
+  const controller = new AbortController();
+  const localSignal = controller.signal;
+  const signal = options.signal;
+  const agentId = options.agentId ?? `localghost-${randomUUID2()}`;
+  const targetHost = options.targetHost ?? "127.0.0.1";
+  const routeTtlSeconds = options.routeTtlSeconds ?? 30;
+  const requestTtlSeconds = options.requestTtlSeconds ?? 60;
+  const pollIntervalMs = options.pollIntervalMs ?? 500;
+  const maxResponseBodyBytes = options.maxResponseBodyBytes ?? 5 * 1024 * 1024;
+  const done = (async () => {
+    if (options.entries.length === 0) {
+      throw new Error("Ghost Tunnel agent requires at least one .ghosttunnel entry.");
+    }
+    options.log?.(`localghost tunnel agent ${agentId}`);
+    for (const entry of options.entries) {
+      options.log?.(`  ${entry.host} -> ${targetHost}:${entry.port}`);
+    }
+    let lastHeartbeat = 0;
+    while (!isStopped(signal, localSignal)) {
+      const now = Date.now();
+      if (now - lastHeartbeat >= Math.max(1e3, Math.floor(routeTtlSeconds * 1e3 / 3))) {
+        await heartbeatRoutes({
+          entries: options.entries,
+          store: options.store,
+          agentId,
+          targetHost,
+          routeTtlSeconds
+        });
+        lastHeartbeat = now;
+      }
+      let served = false;
+      for (const entry of options.entries) {
+        served = await claimAndServe({
+          entry,
+          store: options.store,
+          targetHost,
+          requestTtlSeconds,
+          maxResponseBodyBytes,
+          ...options.fetch ? { fetch: options.fetch } : {}
+        }) || served;
+      }
+      if (!served) {
+        await wait(pollIntervalMs, signal, localSignal);
+      }
+    }
+  })();
+  return {
+    agentId,
+    stop() {
+      controller.abort();
+    },
+    done
+  };
+}
+
 // src/hosts-file.ts
 import { writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { execa as execa3 } from "execa";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -803,7 +1441,8 @@ function getManagedBlockPattern(projectName) {
   const end = `# localghost:end ${sanitizedProjectName}`;
   return new RegExp(`${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, "m");
 }
-function getSystemHostsPath() {
+function getSystemHostsPath(env = process.env) {
+  if (env.LOCALGHOST_HOSTS_PATH) return env.LOCALGHOST_HOSTS_PATH;
   return process.platform === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
 }
 function renderHostsBlock(projectName, entries) {
@@ -834,8 +1473,12 @@ function removeManagedBlock(existing, projectName) {
 }
 async function writeSystemHostsFile(hostsPath, next, projectName) {
   const sanitizedProjectName = sanitizeProjectName(projectName);
-  const tempPath = join5(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
+  const tempPath = join6(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
   writeFileSync3(tempPath, next, "utf8");
+  if (process.env.LOCALGHOST_HOSTS_PATH) {
+    writeFileSync3(hostsPath, next, "utf8");
+    return tempPath;
+  }
   if (process.platform === "win32") {
     throw new Error(`Windows support: run as administrator and copy ${tempPath} to ${hostsPath}.`);
   }
@@ -867,11 +1510,11 @@ async function removeSystemHosts(projectName) {
 }
 
 // src/init.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
 function detectPackageManager(cwd = process.cwd()) {
-  if (existsSync4(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync4(join6(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync5(join7(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(join7(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function packageRunCommand(packageManager, script) {
@@ -889,9 +1532,9 @@ function renderConfig(options) {
     ""
   ].join("\n");
 }
-function readPackageJson(path) {
+function readPackageJson2(path) {
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return null;
   }
@@ -904,7 +1547,7 @@ function getConfigFlag(configFile) {
   return configFile === LOCALGHOST_CONFIG_FILE ? "" : ` --config ${shellQuote(configFile)}`;
 }
 function updatePackageScripts(packageJsonPath, configFile) {
-  const pkg = readPackageJson(packageJsonPath);
+  const pkg = readPackageJson2(packageJsonPath);
   if (!pkg) return false;
   const scripts = typeof pkg.scripts === "object" && pkg.scripts ? pkg.scripts : {};
   const configFlag = getConfigFlag(configFile);
@@ -915,6 +1558,7 @@ function updatePackageScripts(packageJsonPath, configFile) {
     "localghost:proxy:https": scripts["localghost:proxy:https"] ?? `localghost dev${configFlag} --https`,
     "localghost:run": scripts["localghost:run"] ?? `localghost run${configFlag} --`,
     "localghost:ready": scripts["localghost:ready"] ?? `localghost status${configFlag} --ready`,
+    "localghost:repair": scripts["localghost:repair"] ?? `localghost repair${configFlag}`,
     "localghost:trust": scripts["localghost:trust"] ?? `localghost trust${configFlag}`,
     "localghost:ps": scripts["localghost:ps"] ?? "localghost ps",
     "localghost:print": scripts["localghost:print"] ?? `localghost print${configFlag}`,
@@ -943,8 +1587,8 @@ function initLocalghost(options = {}) {
   const apiPort = options.apiPort ?? 8787;
   const packageManager = options.packageManager ?? detectPackageManager(cwd);
   const configFile = options.configFile ?? LOCALGHOST_CONFIG_FILE;
-  const configPath = join6(cwd, configFile);
-  const configExists = existsSync4(configPath);
+  const configPath = join7(cwd, configFile);
+  const configExists = existsSync5(configPath);
   if (configExists && !options.force) {
     return {
       configPath,
@@ -960,12 +1604,12 @@ function initLocalghost(options = {}) {
     };
   }
   writeTextFile(configPath, renderConfig({ host, port, apiHost, apiPort }));
-  const packageJsonPath = join6(cwd, "package.json");
+  const packageJsonPath = join7(cwd, "package.json");
   const packageJsonChanged = options.writeScripts ? updatePackageScripts(packageJsonPath, configFile) : false;
   return {
     configPath,
     configCreated: true,
-    ...existsSync4(packageJsonPath) ? { packageJsonPath } : {},
+    ...existsSync5(packageJsonPath) ? { packageJsonPath } : {},
     packageJsonChanged,
     packageManager,
     nextSteps: [
@@ -1057,21 +1701,22 @@ function formatGhostTunnel(config, options = {}) {
   if (options.verbose) {
     lines.push(`  domains: ${config.domains.length > 0 ? config.domains.join(", ") : "*"}`);
     lines.push(`  access: ${config.requireAuth ? "auth required" : "app decides"}`);
-    lines.push(`  transport: ${config.requireHttps ? "https required" : "http allowed"}`);
+    lines.push(`  protocol: ${config.requireHttps ? "https required" : "http allowed"}`);
+    lines.push(`  transport: ${config.transport.kind}`);
   }
   return lines.join("\n");
 }
 
 // src/state.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
 var LOCALGHOST_STATE_FILE = "ops/local/localghost-state.json";
 function getLocalghostStatePath(cwd = process.cwd()) {
-  return join7(cwd, LOCALGHOST_STATE_FILE);
+  return join8(cwd, LOCALGHOST_STATE_FILE);
 }
 function readLocalghostState(cwd = process.cwd()) {
   const path = getLocalghostStatePath(cwd);
-  if (!existsSync5(path)) return null;
+  if (!existsSync6(path)) return null;
   return JSON.parse(readTextFile(path));
 }
 function writeLocalghostState(cwd, state) {
@@ -1087,11 +1732,11 @@ function patchLocalghostState(cwd, patch) {
 }
 
 // src/update-check.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join8 } from "path";
+import { dirname as dirname4, join as join9 } from "path";
 var LOCALGHOST_PACKAGE_NAME = "@hamedb89/localghost";
-var LOCALGHOST_VERSION = "0.1.9";
+var LOCALGHOST_VERSION = "0.1.12";
 var UPDATE_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_NOTIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_TIMEOUT_MS = 900;
@@ -1103,13 +1748,13 @@ function isUpdateCheckDisabled(env = process.env) {
 }
 function getUpdateCheckCachePath(env = process.env) {
   if (env.LOCALGHOST_UPDATE_CHECK_CACHE) return env.LOCALGHOST_UPDATE_CHECK_CACHE;
-  const cacheRoot = env.XDG_CACHE_HOME || join8(homedir2(), ".cache");
-  return join8(cacheRoot, "localghost", "update-check.json");
+  const cacheRoot = env.XDG_CACHE_HOME || join9(homedir2(), ".cache");
+  return join9(cacheRoot, "localghost", "update-check.json");
 }
 function readCache(path = getUpdateCheckCachePath()) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return null;
   }
@@ -1266,6 +1911,10 @@ function warnAboutLocalMdns(entries) {
 function shouldColor() {
   return process.stdout.isTTY && !process.env.NO_COLOR;
 }
+function printLocalghostBanner() {
+  console.log(renderLocalghostBanner());
+  console.log("");
+}
 function logDomainRoutes(entries, options = {}) {
   console.log(formatDomainRoutes(entries, options));
   if (options.ghostTunnel?.enabled) {
@@ -1304,7 +1953,8 @@ function contextOptionsFromCli(options) {
     ...options.project ? { project: options.project } : {},
     ...options.config && options.config.length > 0 ? { configFiles: options.config } : {},
     ...options.configPattern ? { configPattern: options.configPattern } : {},
-    ...useHttps(options) ? { https: true } : {}
+    ...useHttps(options) ? { https: true } : {},
+    ...typeof options.autoRepair === "boolean" ? { autoRepair: options.autoRepair } : {}
   };
 }
 function readOptionsFromCli(options) {
@@ -1368,7 +2018,7 @@ function getSetupReadiness(options) {
   }
   const hostsPath = getSystemHostsPath();
   try {
-    const hosts = readFileSync7(hostsPath, "utf8");
+    const hosts = readFileSync8(hostsPath, "utf8");
     const expectedHostsBlock = renderHostsBlock(projectName, entries).trimEnd();
     if (!hosts.includes(expectedHostsBlock)) {
       reasons.push(`The Localghost hosts block in ${hostsPath} is missing or stale.`);
@@ -1378,11 +2028,11 @@ function getSetupReadiness(options) {
     reasons.push(`Could not read ${hostsPath}: ${message}`);
   }
   if (!options.ignoreCaddyfile) {
-    if (!existsSync7(caddyfilePath)) {
+    if (!existsSync8(caddyfilePath)) {
       reasons.push(`Missing Caddyfile at ${caddyfilePath}.`);
     } else {
       const expectedCaddyfile = renderCaddyfile(entries, { https });
-      const currentCaddyfile = readFileSync7(caddyfilePath, "utf8");
+      const currentCaddyfile = readFileSync8(caddyfilePath, "utf8");
       if (currentCaddyfile !== expectedCaddyfile) {
         reasons.push(`Caddyfile at ${caddyfilePath} is stale for ${https ? "HTTPS" : "HTTP"} mode.`);
       }
@@ -1426,15 +2076,15 @@ async function runSetupFromReadiness(cwd, https, readiness) {
     entries: readiness.entries
   });
 }
-function wait(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+function wait2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function runTrust(cwd, caddyfilePath) {
-  await wait(350);
+  await wait2(350);
   try {
     await trustCaddy(caddyfilePath);
   } catch {
-    await wait(750);
+    await wait2(750);
     await trustCaddy(caddyfilePath);
   }
   patchLocalghostState(cwd, { caddyTrustedAt: (/* @__PURE__ */ new Date()).toISOString() });
@@ -1474,6 +2124,131 @@ function registerCleanup(id) {
     process.off("exit", cleanup);
   };
 }
+async function resolveServiceRuntimeEntries(services, dynamicPort) {
+  const usedPorts = /* @__PURE__ */ new Set();
+  const resolved = [];
+  for (const service of services) {
+    let port = service.requestedPort;
+    if (dynamicPort) {
+      let found = false;
+      for (let offset = 0; offset < 50; offset += 1) {
+        const candidate = service.requestedPort + offset;
+        if (candidate > 65535 || usedPorts.has(candidate)) continue;
+        if (await isPortAvailable(candidate)) {
+          port = candidate;
+          found = true;
+          break;
+        }
+      }
+      if (!found) {
+        throw new Error(`No available port found for service ${service.name} from ${service.requestedPort}.`);
+      }
+    } else if (usedPorts.has(port)) {
+      throw new Error(`Services cannot start separate commands on the same fixed port: ${port}.`);
+    }
+    usedPorts.add(port);
+    resolved.push({
+      ...service,
+      port,
+      entry: {
+        host: service.host,
+        port,
+        target: `127.0.0.1:${port}`
+      }
+    });
+  }
+  return resolved;
+}
+async function waitForServicePorts(entries, timeoutMs = 1e4) {
+  const deadline = Date.now() + timeoutMs;
+  const ports = [...new Set(entries.map((entry) => entry.port))];
+  while (Date.now() < deadline) {
+    const availability = await Promise.all(ports.map((port) => isPortAvailable(port)));
+    if (availability.every((available) => !available)) return true;
+    await wait2(50);
+  }
+  return false;
+}
+async function runDetectedServices(options) {
+  assertLocalDevelopment("run");
+  await assertCaddyReady();
+  const runtimeServices = await resolveServiceRuntimeEntries(options.services, options.dynamicPort);
+  const entries = runtimeServices.map((service) => service.entry);
+  const readiness = getSetupReadiness({
+    cwd: options.cwd,
+    https: options.https,
+    ignoreCaddyfile: true,
+    entries,
+    configPath: options.configPath,
+    projectName: options.projectName
+  });
+  if (!readiness.ready) {
+    if (!options.autoRepair) {
+      throw new Error([
+        "Localghost setup is missing or stale.",
+        ...readiness.reasons.map((reason) => `- ${reason}`),
+        "Automatic repair is disabled. Enable autoRepair or run localghost repair."
+      ].join("\n"));
+    }
+    console.log("Localghost setup is stale; repairing it now.");
+    await runSetupFromReadiness(options.cwd, options.https, readiness);
+  }
+  for (const service of runtimeServices) {
+    if (service.port !== service.requestedPort) {
+      console.log(`${service.name}: port ${service.requestedPort} is busy; using ${service.port}.`);
+    }
+  }
+  const caddyfile = await writeCaddyfile(entries, options.cwd, { https: options.https });
+  await validateCaddyfile(caddyfile);
+  const caddy = startCaddy(caddyfile);
+  const caddyExit = caddy.catch((error) => {
+    if (!caddy.killed) throw error;
+  });
+  const children = runtimeServices.map((service) => execa4(service.command[0], service.command.slice(1), {
+    cwd: service.cwd,
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      LOCALGHOST_PORT: String(service.port),
+      LOCALGHOST_DYNAMIC_PORT: options.dynamicPort ? "1" : "0",
+      LOCALGHOST_SERVICE: service.name,
+      VITE_PORT: String(service.port)
+    }
+  }));
+  const caddyPid = maybePid(caddy.pid);
+  const runRecord = registerLocalghostRun({
+    mode: "run",
+    cwd: options.cwd,
+    projectName: options.projectName,
+    configPath: options.configPath,
+    caddyfilePath: caddyfile,
+    ...caddyPid ? { caddyPid } : {},
+    childCommand: ["services", ...runtimeServices.map((service) => service.name)],
+    https: options.https,
+    dynamicPort: options.dynamicPort,
+    entries
+  });
+  const cleanupRun = registerCleanup(runRecord.id);
+  const processExit = Promise.race([caddyExit, ...children]);
+  try {
+    const ready = await Promise.race([
+      waitForServicePorts(entries),
+      processExit.then(() => false)
+    ]);
+    if (ready) {
+      console.log("");
+      logDomainRoutes(entries, { https: options.https });
+    }
+    await processExit;
+  } finally {
+    for (const child of children) {
+      if (!child.killed) child.kill("SIGINT");
+    }
+    if (!caddy.killed) caddy.kill("SIGINT");
+    await Promise.allSettled([caddyExit, ...children]);
+    cleanupRun();
+  }
+}
 async function getRouteViews(entries) {
   const portStatus = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -1625,6 +2400,7 @@ program.command("update").description("Check npm for a newer localghost release"
 });
 program.command("setup").description("Update /etc/hosts and generate/validate Caddyfile").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Generate a local HTTPS Caddy proxy with Caddy local certificates").option("--ssl", "Alias for --https").action(async (options) => {
   assertLocalDevelopment("setup");
+  printLocalghostBanner();
   await assertCaddyReady();
   const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
   const https = context.https;
@@ -1682,6 +2458,32 @@ program.command("trust").description("Trust Caddy's local HTTPS CA for this proj
   await validateCaddyfile(caddyfile);
   await runTrust(options.cwd, caddyfile);
 });
+program.command("repair").description("Reconcile stale hosts, Caddyfile, setup state, and optional HTTPS trust").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Repair an HTTPS Caddy setup").option("--ssl", "Alias for --https").option("--trust", "Re-run Caddy's local HTTPS trust step").action(async (options) => {
+  assertLocalDevelopment("repair");
+  printLocalghostBanner();
+  await assertCaddyReady();
+  const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
+  const readiness = getSetupReadiness({
+    ...options,
+    https: context.https,
+    entries: context.entries,
+    configPath: context.configPath,
+    projectName: context.projectName
+  });
+  if (options.trust && !context.https) {
+    throw new Error("Cannot repair HTTPS trust unless HTTPS is enabled. Pass --https or configure https: true.");
+  }
+  warnAboutLocalMdns(context.entries);
+  logDomainRoutes(context.entries, { https: context.https, ghostTunnel: context.ghostTunnel });
+  await runSetupFromReadiness(options.cwd, context.https, readiness);
+  if (options.trust) {
+    await runTrust(options.cwd, readiness.caddyfilePath);
+  }
+  console.log(`Repaired hosts: ${getSystemHostsPath()}`);
+  console.log(`Repaired Caddyfile: ${readiness.caddyfilePath}`);
+  console.log(`Repaired state: ${readiness.statePath}`);
+  console.log("Repair complete.");
+});
 program.command("reset").description("Remove Localghost setup state without deleting .localghost").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).action(async (options) => {
   assertLocalDevelopment("reset");
   const projectName = sanitizeProjectName(options.project ?? getProjectName(options.cwd));
@@ -1689,13 +2491,13 @@ program.command("reset").description("Remove Localghost setup state without dele
   const statePath = getLocalghostStatePath(options.cwd);
   explainHostsPassword();
   const hostsResult = await removeSystemHosts(projectName);
-  if (existsSync7(caddyfilePath)) {
+  if (existsSync8(caddyfilePath)) {
     unlinkSync(caddyfilePath);
     console.log(`Removed ${caddyfilePath}`);
   } else {
     console.log(`${caddyfilePath} was not present`);
   }
-  if (existsSync7(statePath)) {
+  if (existsSync8(statePath)) {
     unlinkSync(statePath);
     console.log(`Removed ${statePath}`);
   } else {
@@ -1716,7 +2518,7 @@ program.command("teardown").description("Remove Localghost's managed /etc/hosts
   const hostsResult = await removeSystemHosts(projectName);
   const caddyfilePath = getCaddyfilePath(options.cwd);
   let caddyfileRemoved = false;
-  if (options.removeCaddyfile && existsSync7(caddyfilePath)) {
+  if (options.removeCaddyfile && existsSync8(caddyfilePath)) {
     unlinkSync(caddyfilePath);
     caddyfileRemoved = true;
   }
@@ -1796,7 +2598,7 @@ program.command("routes").description("Print domain to upstream routes").option(
     }));
   }
 });
-program.command("dev").description("Run the Localghost Caddy proxy after setup").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting the proxy when setup is missing or stale").option("--trust", "Trust Caddy's local HTTPS CA before starting the proxy").action(async (options) => {
+program.command("dev").description("Run the Localghost Caddy proxy, repairing stale setup when needed").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Alias for automatic repair when setup is missing or stale").option("--auto-repair [yes|no]", "Repair stale setup before starting (default: yes)", parseBooleanLike).option("--trust", "Trust Caddy's local HTTPS CA before starting the proxy").action(async (options) => {
   assertLocalDevelopment("dev");
   await assertCaddyReady();
   const context = await resolveLocalghostContext({ ...contextOptionsFromCli(options), dynamicPort: false });
@@ -1809,41 +2611,18 @@ program.command("dev").description("Run the Localghost Caddy proxy after setup")
     projectName: context.projectName
   });
   if (!readiness.ready) {
-    if (!options.setup) {
+    if (!options.setup && !context.autoRepair) {
       throw new Error(
         [
           "Localghost setup is missing or stale.",
           ...readiness.reasons.map((reason) => `- ${reason}`),
           `Run: ${readiness.setupCommand}`,
-          "Or rerun dev with --setup if you want Localghost to perform setup first."
+          "Automatic repair is disabled. Rerun without --auto-repair=no or run localghost repair."
         ].join("\n")
       );
     }
-    explainHostsPassword();
-    const hostsResult = await updateSystemHosts(readiness.projectName, readiness.entries);
-    const caddyfilePath = await writeCaddyfile(readiness.entries, options.cwd, { https });
-    await validateCaddyfile(caddyfilePath);
-    writeLocalghostState(options.cwd, {
-      action: "setup",
-      projectName: readiness.projectName,
-      cwd: options.cwd,
-      configPath: readiness.configPath,
-      hostsPath: hostsResult.hostsPath,
-      hostsChanged: hostsResult.changed,
-      ...hostsResult.tempPath ? { hostsTempPath: hostsResult.tempPath } : {},
-      caddyfilePath,
-      caddyHttps: https,
-      ...existingTrustMarkers(options.cwd),
-      entries: readiness.entries
-    });
-    registerLocalghostSetup({
-      cwd: options.cwd,
-      projectName: readiness.projectName,
-      configPath: readiness.configPath,
-      caddyfilePath,
-      https,
-      entries: readiness.entries
-    });
+    console.log("Localghost setup is stale; repairing it now.");
+    await runSetupFromReadiness(options.cwd, https, readiness);
   }
   warnAboutLocalMdns(readiness.entries);
   logDomainRoutes(readiness.entries, { https, ghostTunnel: context.ghostTunnel });
@@ -1879,7 +2658,7 @@ program.command("dev").description("Run the Localghost Caddy proxy after setup")
     cleanupRun();
   }
 });
-program.command("run").description("Run Caddy and a dev command from the same Localghost context").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--port <number>", "Initial app port", parsePort2).option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Run setup before starting when setup is missing or stale").option("--trust", "Trust Caddy's local HTTPS CA before starting the child command").option("--dynamic-port [yes|no]", "Use the requested port if free, otherwise continue upward", parseBooleanLike).argument("<command...>", "Command to run after --, for example: localghost run -- vite").action(async (command, options) => {
+program.command("run").description("Run Caddy and a dev command from the same Localghost context").option("--project <name>", "Managed /etc/hosts block name").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--port <number>", "Initial app port", parsePort2).option("--https", "Run a local HTTPS proxy with Caddy local certificates").option("--ssl", "Alias for --https").option("--setup", "Alias for automatic repair when setup is missing or stale").option("--auto-repair [yes|no]", "Repair stale setup before starting (default: yes)", parseBooleanLike).option("--trust", "Trust Caddy's local HTTPS CA before starting the child command").option("--dynamic-port [yes|no]", "Use the requested port if free, otherwise continue upward", parseBooleanLike).argument("<command...>", "Command to run after --, for example: localghost run -- vite").action(async (command, options) => {
   assertLocalDevelopment("run");
   await assertCaddyReady();
   const context = await resolveLocalghostContext({
@@ -1889,7 +2668,8 @@ program.command("run").description("Run Caddy and a dev command from the same Lo
     ...options.configPattern ? { configPattern: options.configPattern } : {},
     ...options.port ? { port: options.port } : {},
     ...useHttps(options) ? { https: true } : {},
-    ...typeof options.dynamicPort === "boolean" ? { dynamicPort: options.dynamicPort } : {}
+    ...typeof options.dynamicPort === "boolean" ? { dynamicPort: options.dynamicPort } : {},
+    ...typeof options.autoRepair === "boolean" ? { autoRepair: options.autoRepair } : {}
   });
   const https = context.https;
   const readiness = getSetupReadiness({
@@ -1901,18 +2681,19 @@ program.command("run").description("Run Caddy and a dev command from the same Lo
     projectName: context.projectName
   });
   if (!readiness.ready) {
-    const shouldSetup = options.setup === true || canPrompt() && await confirm("Run caddy:setup now?", true);
-    if (!shouldSetup) {
+    if (!options.setup && !context.autoRepair) {
       throw new Error(
         [
           "Localghost setup is missing or stale.",
           ...readiness.reasons.map((reason) => `- ${reason}`),
-          `Run: ${readiness.setupCommand}`
+          `Run: ${readiness.setupCommand}`,
+          "Automatic repair is disabled. Rerun without --auto-repair=no or run localghost repair."
         ].join("\n")
       );
     }
+    console.log("Localghost setup is stale; repairing it now.");
     await runSetupFromReadiness(options.cwd, https, readiness);
-    console.log(`All set. Setup state: ${getLocalghostStatePath(options.cwd)}`);
+    console.log(`Repair complete. Setup state: ${getLocalghostStatePath(options.cwd)}`);
   }
   if (context.dynamicPort && context.port !== context.requestedPort) {
     console.log(`Port ${context.requestedPort} is busy; using ${context.port}.`);
@@ -1983,6 +2764,53 @@ program.command("run").description("Run Caddy and a dev command from the same Lo
     cleanupRun();
   }
 });
+program.command("tunnel").description("Run the local Ghost Tunnel agent").option("--cwd <path>", "Project directory", process.cwd()).option("--config <file>", "Config file to look for. Can be repeated.", collect, []).option("--config-pattern <regex>", "Regex for config filenames in the project root").option("--ghost-config <file>", "Exact Ghost Tunnel route file", ".ghosttunnel").option("--target-host <host>", "Local target host for .ghosttunnel ports", "127.0.0.1").action(async (options) => {
+  assertLocalDevelopment("tunnel");
+  const context = await resolveLocalghostContext({
+    cwd: options.cwd,
+    ...options.config && options.config.length > 0 ? { configFiles: options.config } : {},
+    ...options.configPattern ? { configPattern: options.configPattern } : {},
+    dynamicPort: false
+  });
+  if (!context.ghostTunnel.enabled) {
+    throw new Error("Ghost Tunnel is not enabled in localghost.config.mjs.");
+  }
+  if (context.ghostTunnel.transport.kind !== "tunnel") {
+    throw new Error(`Ghost Tunnel transport must be tunnel for localghost tunnel. Current: ${context.ghostTunnel.transport.kind}`);
+  }
+  const entries = listGhostTunnelEntries({
+    cwd: options.cwd,
+    fileName: options.ghostConfig
+  });
+  if (entries.length === 0) {
+    throw new Error(`No exact Ghost Tunnel routes found in ${options.ghostConfig}.`);
+  }
+  const transport = context.ghostTunnel.transport;
+  const store = createRedisGhostTunnelStoreFromEnv({
+    namespace: transport.store.namespace
+  });
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+  const agent = startGhostTunnelAgent({
+    entries,
+    store,
+    targetHost: options.targetHost,
+    routeTtlSeconds: transport.routeTtlSeconds,
+    requestTtlSeconds: transport.requestTtlSeconds,
+    pollIntervalMs: transport.pollIntervalMs,
+    maxResponseBodyBytes: transport.maxResponseBodyBytes,
+    signal: controller.signal,
+    log: (message) => console.log(message)
+  });
+  try {
+    await agent.done;
+  } finally {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+  }
+});
 program.command("ps").description("Show Localghost setups and currently running sessions").option("--json", "Print raw JSON").action(async (options) => {
   const setups = listLocalghostSetups();
   const runs = listLocalghostRuns();
@@ -1998,7 +2826,83 @@ program.command("print").description("Print parsed host config").option("--cwd <
   warnAboutLocalMdns(entries);
   console.log(JSON.stringify(entries, null, 2));
 });
-program.parseAsync().catch((error) => {
+function readImplicitInvocation(args) {
+  if (args.some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-V")) return null;
+  let cwd = process.cwd();
+  let dryRun = false;
+  let updateCheck = true;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (!arg) continue;
+    if (arg === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--no-update-check") {
+      updateCheck = false;
+      continue;
+    }
+    if (arg === "--cwd") {
+      const value = args[index + 1];
+      if (!value) throw new Error("--cwd requires a path.");
+      cwd = value;
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("--cwd=")) {
+      cwd = arg.slice("--cwd=".length);
+      continue;
+    }
+    return null;
+  }
+  return { cwd, dryRun, updateCheck };
+}
+async function main() {
+  const implicit = readImplicitInvocation(process.argv.slice(2));
+  if (!implicit) {
+    await program.parseAsync();
+    return;
+  }
+  const projectConfig = await readLocalghostProjectConfig({ cwd: implicit.cwd });
+  printLocalghostBanner();
+  if (projectConfig.config.services) {
+    if (!projectConfig.path) throw new Error("Multi-service configuration must come from localghost.config.mjs.");
+    const services = detectDevServices({
+      cwd: implicit.cwd,
+      services: projectConfig.config.services
+    });
+    console.log(formatDetectedDevServices(services));
+    if (implicit.dryRun) return;
+    await runDetectedServices({
+      cwd: implicit.cwd,
+      services,
+      configPath: projectConfig.path,
+      projectName: sanitizeProjectName(projectConfig.config.project ?? getProjectName(implicit.cwd)),
+      https: projectConfig.config.https ?? false,
+      dynamicPort: projectConfig.config.dynamicPort ?? true,
+      autoRepair: projectConfig.config.autoRepair ?? true
+    });
+    await maybeNotifyAboutUpdate({ disabled: !implicit.updateCheck });
+    return;
+  }
+  const detected = detectDevCommand({
+    cwd: implicit.cwd,
+    ...projectConfig.config.command ? { command: projectConfig.config.command } : {}
+  });
+  console.log(`Localghost detected: ${formatDetectedDevCommand(detected)}`);
+  if (implicit.dryRun) return;
+  await program.parseAsync([
+    process.argv[0] ?? process.execPath,
+    process.argv[1] ?? "localghost",
+    ...implicit.updateCheck ? [] : ["--no-update-check"],
+    "run",
+    "--cwd",
+    implicit.cwd,
+    "--",
+    ...detected.command
+  ]);
+}
+main().catch((error) => {
   const message = error instanceof Error ? error.message : String(error);
   console.error(message);
   process.exitCode = 1;