@lasso-ai/cli 1.4.0 → 1.4.2

package/dist/cli/host/certificates.d.ts

@@ -1,12 +1,13 @@
 export declare const TLS_KEY_FILE: string;
 export declare const TLS_CERT_FILE: string;
-export declare function ensureHostCertificate(): {
+export declare function ensureHostCertificate(onProgress?: (message: string) => void): Promise<{
     ok: boolean;
     trusted: boolean;
     error?: string;
-};
+}>;
 export declare function hostCertificateStatus(): {
     present: boolean;
     certificate: string;
     key: string;
+    trusted: boolean;
 };

package/dist/cli/host/certificates.js

@@ -10,27 +10,238 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const node_https_1 = __importDefault(require("node:https"));
+const node_http_1 = __importDefault(require("node:http"));
 const paths_1 = require("./paths");
 exports.TLS_KEY_FILE = node_path_1.default.join(paths_1.HOST_DIR, "host.key");
 exports.TLS_CERT_FILE = node_path_1.default.join(paths_1.HOST_DIR, "host.crt");
 function hasCertificate() {
     return node_fs_1.default.existsSync(exports.TLS_KEY_FILE) && node_fs_1.default.existsSync(exports.TLS_CERT_FILE);
 }
-function ensureHostCertificate() {
-    node_fs_1.default.mkdirSync(paths_1.HOST_DIR, { recursive: true, mode: 0o700 });
-    if (hasCertificate())
-        return { ok: true, trusted: false };
+function isMkcertInstalled() {
+    // Check system PATH first
     try {
-        (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
-        (0, node_child_process_1.execFileSync)("mkcert", ["-cert-file", exports.TLS_CERT_FILE, "-key-file", exports.TLS_KEY_FILE, "localhost", "127.0.0.1", "::1", "*.lasso"], { stdio: "ignore" });
-        node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
-        return { ok: true, trusted: true };
+        (0, node_child_process_1.execFileSync)("mkcert", ["-version"], { stdio: "ignore" });
+        return true;
     }
     catch {
-        // mkcert is optional; OpenSSL still provides a usable local certificate.
+        // Check local installation
+        try {
+            const localMkcert = node_path_1.default.join(node_os_1.default.homedir(), ".lasso", "bin", "mkcert");
+            if (node_fs_1.default.existsSync(localMkcert)) {
+                (0, node_child_process_1.execFileSync)(localMkcert, ["-version"], { stdio: "ignore" });
+                return true;
+            }
+        }
+        catch { }
+        return false;
+    }
+}
+function getMkcertPath() {
+    // Check local installation first
+    const localMkcert = node_path_1.default.join(node_os_1.default.homedir(), ".lasso", "bin", "mkcert");
+    if (node_fs_1.default.existsSync(localMkcert)) {
+        return localMkcert;
+    }
+    return "mkcert";
+}
+async function downloadMkcert() {
+    const platform = node_os_1.default.platform();
+    const arch = node_os_1.default.arch();
+    let downloadUrl;
+    let binaryName;
+    // Determine the correct binary for the platform
+    if (platform === "darwin") {
+        if (arch === "x64") {
+            downloadUrl = "https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-darwin-amd64";
+            binaryName = "mkcert-darwin-amd64";
+        }
+        else if (arch === "arm64") {
+            downloadUrl = "https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-darwin-arm64";
+            binaryName = "mkcert-darwin-arm64";
+        }
+        else {
+            return { ok: false, error: `Unsupported architecture: ${arch}` };
+        }
+    }
+    else if (platform === "linux") {
+        if (arch === "x64") {
+            downloadUrl = "https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64";
+            binaryName = "mkcert-linux-amd64";
+        }
+        else if (arch === "arm64") {
+            downloadUrl = "https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-arm64";
+            binaryName = "mkcert-linux-arm64";
+        }
+        else {
+            return { ok: false, error: `Unsupported architecture: ${arch}` };
+        }
+    }
+    else {
+        return { ok: false, error: `Unsupported platform: ${platform}` };
+    }
+    return new Promise((resolve) => {
+        const protocol = downloadUrl.startsWith("https") ? node_https_1.default : node_http_1.default;
+        const tempDir = node_os_1.default.tmpdir();
+        const tempPath = node_path_1.default.join(tempDir, binaryName);
+        console.log(`[Lasso] Downloading mkcert from ${downloadUrl}...`);
+        const file = node_fs_1.default.createWriteStream(tempPath);
+        protocol.get(downloadUrl, (response) => {
+            if (response.statusCode !== 200) {
+                node_fs_1.default.unlinkSync(tempPath);
+                return resolve({ ok: false, error: `Failed to download mkcert: ${response.statusCode}` });
+            }
+            response.pipe(file);
+            file.on("finish", () => {
+                file.close();
+                node_fs_1.default.chmodSync(tempPath, 0o755);
+                console.log(`[Lasso] ✓ mkcert downloaded to ${tempPath}`);
+                resolve({ ok: true, path: tempPath });
+            });
+        }).on("error", (error) => {
+            node_fs_1.default.unlinkSync(tempPath);
+            resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+        });
+    });
+}
+async function installMkcert() {
+    const platform = node_os_1.default.platform();
+    // Try package manager first
+    if (platform === "darwin") {
+        try {
+            (0, node_child_process_1.execFileSync)("brew", ["--version"], { stdio: "ignore" });
+            console.log("[Lasso] Installing mkcert via Homebrew...");
+            const installResult = await new Promise((resolve) => {
+                const install = (0, node_child_process_1.spawn)("brew", ["install", "mkcert", "nss"], { stdio: "inherit" });
+                install.on("close", (code) => {
+                    if (code === 0)
+                        resolve({ ok: true });
+                    else
+                        resolve({ ok: false, error: `Homebrew install failed with code ${code}` });
+                });
+                install.on("error", (error) => {
+                    resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+                });
+            });
+            if (installResult.ok) {
+                (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
+                console.log("[Lasso] ✓ mkcert installed and CA configured");
+                return { ok: true };
+            }
+        }
+        catch {
+            console.log("[Lasso] Homebrew not available, trying direct download...");
+        }
+    }
+    else if (platform === "linux") {
+        try {
+            (0, node_child_process_1.execFileSync)("apt-get", ["--version"], { stdio: "ignore" });
+            console.log("[Lasso] Installing mkcert via apt-get...");
+            const installResult = await new Promise((resolve) => {
+                const install = (0, node_child_process_1.spawn)("sudo", ["apt-get", "install", "-y", "mkcert"], { stdio: "inherit" });
+                install.on("close", (code) => {
+                    if (code === 0)
+                        resolve({ ok: true });
+                    else
+                        resolve({ ok: false, error: `apt-get install failed with code ${code}` });
+                });
+                install.on("error", (error) => {
+                    resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+                });
+            });
+            if (installResult.ok) {
+                (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
+                console.log("[Lasso] ✓ mkcert installed and CA configured");
+                return { ok: true };
+            }
+        }
+        catch {
+            try {
+                (0, node_child_process_1.execFileSync)("dnf", ["--version"], { stdio: "ignore" });
+                console.log("[Lasso] Installing mkcert via dnf...");
+                const installResult = await new Promise((resolve) => {
+                    const install = (0, node_child_process_1.spawn)("sudo", ["dnf", "install", "-y", "mkcert"], { stdio: "inherit" });
+                    install.on("close", (code) => {
+                        if (code === 0)
+                            resolve({ ok: true });
+                        else
+                            resolve({ ok: false, error: `dnf install failed with code ${code}` });
+                    });
+                    install.on("error", (error) => {
+                        resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+                    });
+                });
+                if (installResult.ok) {
+                    (0, node_child_process_1.execFileSync)("mkcert", ["-install"], { stdio: "ignore" });
+                    console.log("[Lasso] ✓ mkcert installed and CA configured");
+                    return { ok: true };
+                }
+            }
+            catch {
+                console.log("[Lasso] Package manager not available, trying direct download...");
+            }
+        }
+    }
+    // Fallback: Download mkcert binary directly from GitHub
+    console.log("[Lasso] Downloading mkcert binary from GitHub...");
+    const downloadResult = await downloadMkcert();
+    if (!downloadResult.ok || !downloadResult.path) {
+        return { ok: false, error: downloadResult.error || "Failed to download mkcert binary" };
     }
+    // Copy binary to a permanent location
+    const binDir = node_path_1.default.join(node_os_1.default.homedir(), ".lasso", "bin");
+    node_fs_1.default.mkdirSync(binDir, { recursive: true, mode: 0o755 });
+    const mkcertPath = node_path_1.default.join(binDir, "mkcert");
+    node_fs_1.default.copyFileSync(downloadResult.path, mkcertPath);
+    node_fs_1.default.chmodSync(mkcertPath, 0o755);
+    // Clean up temp file
+    try {
+        node_fs_1.default.unlinkSync(downloadResult.path);
+    }
+    catch { }
+    // Install the local CA using the downloaded binary
+    try {
+        (0, node_child_process_1.execFileSync)(mkcertPath, ["-install"], { stdio: "inherit" });
+        console.log("[Lasso] ✓ mkcert installed and CA configured");
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+async function ensureHostCertificate(onProgress) {
+    node_fs_1.default.mkdirSync(paths_1.HOST_DIR, { recursive: true, mode: 0o700 });
+    if (hasCertificate()) {
+        const certStatus = hostCertificateStatus();
+        return { ok: true, trusted: certStatus.trusted };
+    }
+    onProgress?.("Generating SSL certificate...");
+    // Try mkcert first - it creates system-trusted certificates
+    if (!isMkcertInstalled()) {
+        onProgress?.("mkcert not found, installing...");
+        const installResult = await installMkcert();
+        if (!installResult.ok) {
+            console.warn(`[Lasso] ${installResult.error}`);
+            console.warn("[Lasso] Falling back to OpenSSL (certificate will show as not secure)");
+        }
+    }
+    if (isMkcertInstalled()) {
+        try {
+            onProgress?.("Creating trusted certificate with mkcert...");
+            const mkcertPath = getMkcertPath();
+            (0, node_child_process_1.execFileSync)(mkcertPath, ["-cert-file", exports.TLS_CERT_FILE, "-key-file", exports.TLS_KEY_FILE, "localhost", "127.0.0.1", "::1", "*.lasso"], { stdio: "ignore" });
+            node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
+            onProgress?.("✓ SSL certificate ready (trusted)");
+            return { ok: true, trusted: true };
+        }
+        catch (mkcertError) {
+            console.warn("[Lasso] mkcert failed, falling back to OpenSSL");
+        }
+    }
+    // Fallback to OpenSSL - creates self-signed certificate (not trusted by browsers)
     const configFile = node_path_1.default.join(node_os_1.default.tmpdir(), `lasso-host-${process.pid}.cnf`);
     try {
+        onProgress?.("Creating self-signed certificate with OpenSSL...");
         node_fs_1.default.writeFileSync(configFile, [
             "[req]", "distinguished_name = req_distinguished_name", "x509_extensions = v3_req", "prompt = no",
             "[req_distinguished_name]", "CN = *.lasso", "[v3_req]",
@@ -38,6 +249,7 @@ function ensureHostCertificate() {
         ].join("\n"), { mode: 0o600 });
         (0, node_child_process_1.execFileSync)("openssl", ["req", "-x509", "-nodes", "-newkey", "rsa:2048", "-keyout", exports.TLS_KEY_FILE, "-out", exports.TLS_CERT_FILE, "-days", "825", "-config", configFile], { stdio: "ignore" });
         node_fs_1.default.chmodSync(exports.TLS_KEY_FILE, 0o600);
+        onProgress?.("✓ SSL certificate ready (self-signed)");
         return { ok: true, trusted: false };
     }
     catch (error) {
@@ -48,5 +260,17 @@ function ensureHostCertificate() {
     }
 }
 function hostCertificateStatus() {
-    return { present: hasCertificate(), certificate: exports.TLS_CERT_FILE, key: exports.TLS_KEY_FILE };
+    // Check if certificate was created by mkcert (trusted) or OpenSSL (self-signed)
+    let trusted = false;
+    if (hasCertificate()) {
+        try {
+            const certContent = node_fs_1.default.readFileSync(exports.TLS_CERT_FILE, "utf8");
+            // mkcert certificates include "mkcert" in the issuer
+            trusted = certContent.includes("mkcert");
+        }
+        catch {
+            // If we can't read the cert, assume not trusted
+        }
+    }
+    return { present: hasCertificate(), certificate: exports.TLS_CERT_FILE, key: exports.TLS_KEY_FILE, trusted };
 }

package/dist/cli/host/client.d.ts

@@ -7,6 +7,7 @@ export interface HostHealth {
     proxyPort?: number | null;
     httpsPort?: number | null;
     https?: boolean;
+    trusted?: boolean;
     dnsPort?: number | null;
     running?: number;
     registered?: number;

package/dist/cli/host/daemon.js

@@ -60,10 +60,10 @@ class LassoHost {
     proxies = new Map();
     constructor(opts) {
         this.opts = opts;
-        this.server = node_http_1.default.createServer((req, res) => this.handleRequest(req, res));
-        this.server.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head));
-        this.secureServer = node_https_1.default.createServer({}, (req, res) => this.handleRequest(req, res));
-        this.secureServer.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head));
+        this.server = node_http_1.default.createServer((req, res) => this.handleRequest(req, res, false));
+        this.server.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head, false));
+        this.secureServer = node_https_1.default.createServer({}, (req, res) => this.handleRequest(req, res, true));
+        this.secureServer.on("upgrade", (req, socket, head) => this.handleUpgrade(req, socket, head, true));
         this.resolver = (0, dns_1.createDomainResolver)();
         this.registry = (0, registry_1.loadRegistry)();
         for (const domain of Object.keys(this.registry))
@@ -246,6 +246,7 @@ class LassoHost {
         ];
     }
     health(res) {
+        const certStatus = (0, certificates_1.hostCertificateStatus)();
         writeJson(res, 200, {
             ok: true,
             service: exports.SERVICE_NAME,
@@ -256,14 +257,15 @@ class LassoHost {
             dnsPort: this.dnsHandle?.port ?? null,
             proxyPort: this.opts.proxyPort,
             httpsPort: this.opts.httpsPort,
-            https: (0, certificates_1.hostCertificateStatus)().present,
+            https: certStatus.present,
+            trusted: certStatus.trusted,
             running: this.running.size,
             registered: Object.keys(this.registry).length,
             projects: this.projectList(),
         });
     }
     // ---- request handling --------------------------------------------
-    handleRequest(req, res) {
+    handleRequest(req, res, isSecure = false) {
         const url = req.url || "/";
         const route = this.routes().find((r) => r.route === `${req.method} ${url}`);
         if (route) {
@@ -283,6 +285,13 @@ class LassoHost {
             writeJson(res, 404, { ok: false, error: "Lasso Host only proxies *.lasso domains.", host: req.headers.host });
             return;
         }
+        // Redirect HTTP to HTTPS for .lasso domains
+        if (!isSecure) {
+            const httpsUrl = `https://${hostname}${url}`;
+            res.writeHead(301, { Location: httpsUrl });
+            res.end();
+            return;
+        }
         void this.proxyToProject(hostname, req, res);
     }
     async proxyToProject(hostname, req, res) {
@@ -309,13 +318,20 @@ class LassoHost {
                 res.destroy();
         });
     }
-    handleUpgrade(req, socket, head) {
+    handleUpgrade(req, socket, head, isSecure) {
         const hostname = (0, paths_1.domainOf)(req.headers.host || "");
         if (!(0, paths_1.isLassoDomain)(hostname)) {
             socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
             socket.destroy();
             return;
         }
+        // Redirect HTTP WebSocket upgrades to HTTPS
+        if (!isSecure) {
+            const wsUrl = `wss://${hostname}${req.url}`;
+            socket.write(`HTTP/1.1 301 Moved Permanently\r\nLocation: ${wsUrl}\r\nConnection: close\r\n\r\n`);
+            socket.destroy();
+            return;
+        }
         void (async () => {
             let runtime;
             try {
@@ -345,7 +361,7 @@ class LassoHost {
             this.dnsHandle = null;
             this.log(`dns server failed to start on ${this.opts.dnsPort}: ${line(error)}`);
         }
-        const certificate = (0, certificates_1.ensureHostCertificate)();
+        const certificate = await (0, certificates_1.ensureHostCertificate)((message) => this.log(message));
         if (!certificate.ok)
             this.log(`https certificate unavailable: ${certificate.error}`);
         else {

package/dist/cli/index.js

@@ -147,7 +147,7 @@ const daemon = program.command("daemon [action]")
             console.log(chalk_1.default.bold("Lasso Host"));
             console.log(chalk_1.default.dim(`  Status: ${report.running ? chalk_1.default.green("running") + (report.pid ? ` (pid ${report.pid})` : "") : chalk_1.default.red("not running")}`));
             console.log(chalk_1.default.dim(`  Proxy port: ${(0, paths_1.hostProxyPort)(env)}`));
-            console.log(chalk_1.default.dim(`  HTTPS port: ${(0, paths_1.hostHttpsPort)(env)}${report.health?.https ? chalk_1.default.green(" (certificate ready)") : chalk_1.default.yellow(" (certificate unavailable)")}`));
+            console.log(chalk_1.default.dim(`  HTTPS port: ${(0, paths_1.hostHttpsPort)(env)}${report.health?.https ? (report.health.trusted ? chalk_1.default.green(" (trusted)") : chalk_1.default.yellow(" (self-signed)")) : chalk_1.default.yellow(" (certificate unavailable)")}`));
             console.log(chalk_1.default.dim(`  DNS port: ${(0, paths_1.hostDnsPort)(env)}`));
             console.log(chalk_1.default.dim(`  Domain resolution: ${report.resolver.installed ? chalk_1.default.green("configured") : chalk_1.default.yellow("not configured")} — ${report.resolver.detail}`));
             console.log(chalk_1.default.dim(`  Automatic startup: ${report.autoStart ? chalk_1.default.green("enabled (LaunchAgent)") : chalk_1.default.yellow("disabled")}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lasso-ai/cli",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Select any part of your running app, describe a change, and let AI edit the real source code.",
   "type": "commonjs",
   "main": "dist/cli/index.js",