@lasso-ai/cli 1.4.0 → 1.4.1

package/dist/cli/host/certificates.d.ts

@@ -1,12 +1,13 @@
 export declare const TLS_KEY_FILE: string;
 export declare const TLS_CERT_FILE: string;
-export declare function ensureHostCertificate(): {
+export declare function ensureHostCertificate(onProgress?: (message: string) => void): Promise<{
     ok: boolean;
     trusted: boolean;
     error?: string;
-};
+}>;
 export declare function hostCertificateStatus(): {
     present: boolean;
     certificate: string;
     key: string;
+    trusted: boolean;
 };

package/dist/cli/host/certificates.js

@@ -16,21 +16,107 @@ exports.TLS_CERT_FILE = node_path_1.default.join(paths_1.HOST_DIR, "host.crt");
 function hasCertificate() {
     return node_fs_1.default.existsSync(exports.TLS_KEY_FILE) && node_fs_1.default.existsSync(exports.TLS_CERT_FILE);
 }
-function ensureHostCertificate() {
-    node_fs_1.default.mkdirSync(paths_1.HOST_DIR, { recursive: true, mode: 0o700 });
-    if (hasCertificate())
-        return { ok: true, trusted: false };
+function isMkcertInstalled() {
     try {
-        (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
-        (0, node_child_process_1.execFileSync)("mkcert", ["-cert-file", exports.TLS_CERT_FILE, "-key-file", exports.TLS_KEY_FILE, "localhost", "127.0.0.1", "::1", "*.lasso"], { stdio: "ignore" });
-        node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
-        return { ok: true, trusted: true };
+        (0, node_child_process_1.execFileSync)("mkcert", ["-version"], { stdio: "ignore" });
+        return true;
     }
     catch {
-        // mkcert is optional; OpenSSL still provides a usable local certificate.
+        return false;
+    }
+}
+async function installMkcert() {
+    return new Promise((resolve) => {
+        const platform = node_os_1.default.platform();
+        let installCommand;
+        let installArgs;
+        if (platform === "darwin") {
+            // macOS: Check if Homebrew is available
+            try {
+                (0, node_child_process_1.execFileSync)("brew", ["--version"], { stdio: "ignore" });
+                installCommand = "brew";
+                installArgs = ["install", "mkcert", "nss"];
+            }
+            catch {
+                return resolve({ ok: false, error: "Homebrew not found. Please install Homebrew first: https://brew.sh/" });
+            }
+        }
+        else if (platform === "linux") {
+            // Linux: Try different package managers
+            try {
+                (0, node_child_process_1.execFileSync)("apt-get", ["--version"], { stdio: "ignore" });
+                installCommand = "sudo";
+                installArgs = ["apt-get", "install", "-y", "mkcert"];
+            }
+            catch {
+                try {
+                    (0, node_child_process_1.execFileSync)("dnf", ["--version"], { stdio: "ignore" });
+                    installCommand = "sudo";
+                    installArgs = ["dnf", "install", "-y", "mkcert"];
+                }
+                catch {
+                    return resolve({ ok: false, error: "Could not detect package manager. Please install mkcert manually: https://mkcert.dev/" });
+                }
+            }
+        }
+        else {
+            return resolve({ ok: false, error: `Automatic mkcert installation not supported on ${platform}. Please install manually: https://mkcert.dev/` });
+        }
+        console.log(`[Lasso] Installing mkcert (this may require sudo password)...`);
+        const install = (0, node_child_process_1.spawn)(installCommand, installArgs, { stdio: "inherit" });
+        install.on("close", (code) => {
+            if (code === 0) {
+                // Install the local CA
+                try {
+                    (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
+                    console.log("[Lasso] ✓ mkcert installed and CA configured");
+                    resolve({ ok: true });
+                }
+                catch (error) {
+                    resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+                }
+            }
+            else {
+                resolve({ ok: false, error: `mkcert installation failed with code ${code}` });
+            }
+        });
+        install.on("error", (error) => {
+            resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+        });
+    });
+}
+async function ensureHostCertificate(onProgress) {
+    node_fs_1.default.mkdirSync(paths_1.HOST_DIR, { recursive: true, mode: 0o700 });
+    if (hasCertificate()) {
+        const certStatus = hostCertificateStatus();
+        return { ok: true, trusted: certStatus.trusted };
+    }
+    onProgress?.("Generating SSL certificate...");
+    // Try mkcert first - it creates system-trusted certificates
+    if (!isMkcertInstalled()) {
+        onProgress?.("mkcert not found, installing...");
+        const installResult = await installMkcert();
+        if (!installResult.ok) {
+            console.warn(`[Lasso] ${installResult.error}`);
+            console.warn("[Lasso] Falling back to OpenSSL (certificate will show as not secure)");
+        }
     }
+    if (isMkcertInstalled()) {
+        try {
+            onProgress?.("Creating trusted certificate with mkcert...");
+            (0, node_child_process_1.execFileSync)("mkcert", ["-cert-file", exports.TLS_CERT_FILE, "-key-file", exports.TLS_KEY_FILE, "localhost", "127.0.0.1", "::1", "*.lasso"], { stdio: "ignore" });
+            node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
+            onProgress?.("✓ SSL certificate ready (trusted)");
+            return { ok: true, trusted: true };
+        }
+        catch (mkcertError) {
+            console.warn("[Lasso] mkcert failed, falling back to OpenSSL");
+        }
+    }
+    // Fallback to OpenSSL - creates self-signed certificate (not trusted by browsers)
     const configFile = node_path_1.default.join(node_os_1.default.tmpdir(), `lasso-host-${process.pid}.cnf`);
     try {
+        onProgress?.("Creating self-signed certificate with OpenSSL...");
         node_fs_1.default.writeFileSync(configFile, [
             "[req]", "distinguished_name = req_distinguished_name", "x509_extensions = v3_req", "prompt = no",
             "[req_distinguished_name]", "CN = *.lasso", "[v3_req]",
@@ -38,6 +124,7 @@ function ensureHostCertificate() {
         ].join("\n"), { mode: 0o600 });
         (0, node_child_process_1.execFileSync)("openssl", ["req", "-x509", "-nodes", "-newkey", "rsa:2048", "-keyout", exports.TLS_KEY_FILE, "-out", exports.TLS_CERT_FILE, "-days", "825", "-config", configFile], { stdio: "ignore" });
         node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
+        onProgress?.("✓ SSL certificate ready (self-signed)");
         return { ok: true, trusted: false };
     }
     catch (error) {
@@ -48,5 +135,17 @@ function ensureHostCertificate() {
     }
 }
 function hostCertificateStatus() {
-    return { present: hasCertificate(), certificate: exports.TLS_CERT_FILE, key: exports.TLS_KEY_FILE };
+    // Check if certificate was created by mkcert (trusted) or OpenSSL (self-signed)
+    let trusted = false;
+    if (hasCertificate()) {
+        try {
+            const certContent = node_fs_1.default.readFileSync(exports.TLS_CERT_FILE, "utf8");
+            // mkcert certificates include "mkcert" in the issuer
+            trusted = certContent.includes("mkcert");
+        }
+        catch {
+            // If we can't read the cert, assume not trusted
+        }
+    }
+    return { present: hasCertificate(), certificate: exports.TLS_CERT_FILE, key: exports.TLS_KEY_FILE, trusted };
 }

package/dist/cli/host/client.d.ts

@@ -7,6 +7,7 @@ export interface HostHealth {
     proxyPort?: number | null;
     httpsPort?: number | null;
     https?: boolean;
+    trusted?: boolean;
     dnsPort?: number | null;
     running?: number;
     registered?: number;

package/dist/cli/host/daemon.js

@@ -60,10 +60,10 @@ class LassoHost {
     proxies = new Map();
     constructor(opts) {
         this.opts = opts;
-        this.server = node_http_1.default.createServer((req, res) => this.handleRequest(req, res));
-        this.server.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head));
-        this.secureServer = node_https_1.default.createServer({}, (req, res) => this.handleRequest(req, res));
-        this.secureServer.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head));
+        this.server = node_http_1.default.createServer((req, res) => this.handleRequest(req, res, false));
+        this.server.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head, false));
+        this.secureServer = node_https_1.default.createServer({}, (req, res) => this.handleRequest(req, res, true));
+        this.secureServer.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head, true));
         this.resolver = (0, dns_1.createDomainResolver)();
         this.registry = (0, registry_1.loadRegistry)();
         for (const domain of Object.keys(this.registry))
@@ -246,6 +246,7 @@ class LassoHost {
         ];
     }
     health(res) {
+        const certStatus = (0, certificates_1.hostCertificateStatus)();
         writeJson(res, 200, {
             ok: true,
             service: exports.SERVICE_NAME,
@@ -256,14 +257,15 @@ class LassoHost {
             dnsPort: this.dnsHandle?.port ?? null,
             proxyPort: this.opts.proxyPort,
             httpsPort: this.opts.httpsPort,
-            https: (0, certificates_1.hostCertificateStatus)().present,
+            https: certStatus.present,
+            trusted: certStatus.trusted,
             running: this.running.size,
             registered: Object.keys(this.registry).length,
             projects: this.projectList(),
         });
     }
     // ---- request handling --------------------------------------------
-    handleRequest(req, res) {
+    handleRequest(req, res, isSecure = false) {
         const url = req.url || "/";
         const route = this.routes().find((r) => r.route === `${req.method} ${url}`);
         if (route) {
@@ -283,6 +285,13 @@ class LassoHost {
             writeJson(res, 404, { ok: false, error: "Lasso Host only proxies *.lasso domains.", host: req.headers.host });
             return;
         }
+        // Redirect HTTP to HTTPS for .lasso domains
+        if (!isSecure) {
+            const httpsUrl = `https://${hostname}${url}`;
+            res.writeHead(301, { Location: httpsUrl });
+            res.end();
+            return;
+        }
         void this.proxyToProject(hostname, req, res);
     }
     async proxyToProject(hostname, req, res) {
@@ -309,13 +318,20 @@ class LassoHost {
                 res.destroy();
         });
     }
-    handleUpgrade(req, socket, head) {
+    handleUpgrade(req, socket, head, isSecure) {
         const hostname = (0, paths_1.domainOf)(req.headers.host || "");
         if (!(0, paths_1.isLassoDomain)(hostname)) {
             socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
             socket.destroy();
             return;
         }
+        // Redirect HTTP WebSocket upgrades to HTTPS
+        if (!isSecure) {
+            const wsUrl = `wss://${hostname}${req.url}`;
+            socket.write(`HTTP/1.1 301 Moved Permanently\r\nLocation: ${wsUrl}\r\nConnection: close\r\n\r\n`);
+            socket.destroy();
+            return;
+        }
         void (async () => {
             let runtime;
             try {
@@ -345,7 +361,7 @@ class LassoHost {
             this.dnsHandle = null;
             this.log(`dns server failed to start on ${this.opts.dnsPort}: ${line(error)}`);
         }
-        const certificate = (0, certificates_1.ensureHostCertificate)();
+        const certificate = await (0, certificates_1.ensureHostCertificate)((message) => this.log(message));
         if (!certificate.ok)
             this.log(`https certificate unavailable: ${certificate.error}`);
         else {

package/dist/cli/index.js

@@ -147,7 +147,7 @@ const daemon = program.command("daemon [action]")
             console.log(chalk_1.default.bold("Lasso Host"));
             console.log(chalk_1.default.dim(`  Status: ${report.running ? chalk_1.default.green("running") + (report.pid ? ` (pid ${report.pid})` : "") : chalk_1.default.red("not running")}`));
             console.log(chalk_1.default.dim(`  Proxy port: ${(0, paths_1.hostProxyPort)(env)}`));
-            console.log(chalk_1.default.dim(`  HTTPS port: ${(0, paths_1.hostHttpsPort)(env)}${report.health?.https ? chalk_1.default.green(" (certificate ready)") : chalk_1.default.yellow(" (certificate unavailable)")}`));
+            console.log(chalk_1.default.dim(`  HTTPS port: ${(0, paths_1.hostHttpsPort)(env)}${report.health?.https ? (report.health.trusted ? chalk_1.default.green(" (trusted)") : chalk_1.default.yellow(" (self-signed)")) : chalk_1.default.yellow(" (certificate unavailable)")}`));
             console.log(chalk_1.default.dim(`  DNS port: ${(0, paths_1.hostDnsPort)(env)}`));
             console.log(chalk_1.default.dim(`  Domain resolution: ${report.resolver.installed ? chalk_1.default.green("configured") : chalk_1.default.yellow("not configured")} — ${report.resolver.detail}`));
             console.log(chalk_1.default.dim(`  Automatic startup: ${report.autoStart ? chalk_1.default.green("enabled (LaunchAgent)") : chalk_1.default.yellow("disabled")}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lasso-ai/cli",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Select any part of your running app, describe a change, and let AI edit the real source code.",
   "type": "commonjs",
   "main": "dist/cli/index.js",