@rip-lang/server 1.4.2 → 1.4.4

package/README.md

@@ -359,6 +359,18 @@ or:
 curl --unix-socket /tmp/rip_myapp.ctl.sock -X POST http://localhost/reload
 ```
 
+### Binding to ports 80 and 443
+
+Ports below 1024 require elevated privileges. If you see a permission
+error on startup, grant Bun the capability once:
+
+```bash
+sudo setcap cap_net_bind_service=+ep $(which bun)
+```
+
+This survives reboots but **not Bun upgrades** — re-run it after
+`bun upgrade`.
+
 ### Diagnostics
 
 ```bash

package/acme/manager.rip

@@ -95,7 +95,7 @@ export createAcmeManager = (options = {}) ->
         for domain in domains
           try manager.renewIfNeeded!(domain)
           catch e
-            console.error "rip-acme: renewal failed for #{domain}:", e.message
+            warn "rip-acme: renewal failed for #{domain}:", e.message
       renewalTimer = setInterval(check, intervalMs)
       # Run first check after a short delay
       setTimeout(check, 5000)

package/api.rip

@@ -272,7 +272,7 @@ smart = (fn) ->
       result
     catch err
       status = err?.status or 500
-      console.error 'Handler error:', err if status >= 500
+      warn 'Handler error:', err if status >= 500
       if err?.notice
         body = JSON.stringify { error: { notice: err.notice } }
         new Response body, { status, headers: { 'Content-Type': 'application/json' } }
@@ -389,7 +389,7 @@ runHandler = (c, handler) ->
     compose!(_middlewares, _beforeFilters, _afterFilters, handler)(c)
     c._response or new Response('', { status: 204 })
   catch err
-    console.error 'Request error:', err if not err?.status or err.status >= 500
+    warn 'Request error:', err if not err?.status or err.status >= 500
     if _errorHandler?
       _errorHandler.call!(c, err, c)
     else
@@ -413,7 +413,7 @@ export start = (opts = {}) ->
   host = opts.host or 'localhost'
   port = opts.port or 3000
   server = Bun.serve { hostname: host, port: port, fetch: handler }
-  console.log "rip-api listening on http://#{host}:#{port}" unless opts.silent
+  p "rip-api listening on http://#{host}:#{port}" unless opts.silent
   server
 
 export App = (fn) ->

package/browse.rip

@@ -5,8 +5,9 @@
 # Built-in file browser when no index.rip or index.ts exists in the target
 # directory. Activated automatically by `rip server` when no app entry is found.
 #
-# Default mode is run: HTML renders, images display.
-# Text files that can't run are shown with syntax highlighting.
+# Single-click serves files natively (HTML renders, images display, etc.).
+# Double-click (appends ?) shows syntax-highlighted source for text files.
+# Markdown always renders. Directories show a listing with index file detection.
 # ==============================================================================
 
 import { use, start, notFound } from '@rip-lang/server'
@@ -23,8 +24,10 @@ notFound ->
     res = serveRipHighlightGrammar()
     return res if res
 
-  reqPath = try decodeURIComponent(@req.path) catch then @req.path
+  url = new URL(@req.url)
+  reqPath = try decodeURIComponent(url.pathname) catch then url.pathname
   path = resolve(root, reqPath.slice(1))
+  viewSource = url.search is '?'
 
   unless path is root or path.startsWith(rootSlash)
     return new Response 'Not Found', { status: 404 }
@@ -37,12 +40,11 @@ notFound ->
   if stat.isFile()
     accept = @req.header('accept') or ''
     if accept.includes('text/html')
-      if path.endsWith('.md')
+      if path.endsWith('.md') and not viewSource
         try
           html = renderMarkdown(path)
           return new Response html, { headers: { 'Content-Type': 'text/html; charset=UTF-8' } }
-      # Text files that can't "run" get syntax highlighted
-      if isTextFile(path) and not path.endsWith('.html') and not path.endsWith('.htm') and not path.endsWith('.rip')
+      if viewSource and isTextFile(path)
         try
           html = renderTextFile(path)
           return new Response html, { headers: { 'Content-Type': 'text/html; charset=UTF-8' } }

package/control/cli.rip

@@ -51,7 +51,7 @@ export resolveAppEntry = (appPathInput, defaultEntryPath = null) ->
       entryPath = defaultEntryPath or abs
   else
     unless existsSync(abs)
-      console.error "App path not found: #{abs}"
+      warn "App path not found: #{abs}"
       exit 2
     baseDir = dirname(abs)
     entryPath = abs
@@ -383,7 +383,7 @@ export stopServer = (prefix, getPidFilePathFn, existsSyncFn, readFileSyncFn, kil
       p "rip-server: no PID file found at #{pidFile}, trying pkill..."
       spawnSyncFn(['pkill', '-f', importMetaPath])
   catch e
-    console.error "rip-server: stop failed: #{e.message}"
+    warn "rip-server: stop failed: #{e.message}"
 
 export reloadConfig = (prefix, getControlSocketPathFn, fetchFn, exitFn) ->
   controlUnix = getControlSocketPathFn(prefix)
@@ -394,10 +394,10 @@ export reloadConfig = (prefix, getControlSocketPathFn, fetchFn, exitFn) ->
       p "rip-server: config reload applied"
     else
       reason = j?.reason or 'unknown'
-      console.error "rip-server: config reload rejected: #{reason}"
+      warn "rip-server: config reload rejected: #{reason}"
       exitFn(1)
   catch e
-    console.error "rip-server: reload failed: #{e?.message or e}"
+    warn "rip-server: reload failed: #{e?.message or e}"
     exitFn(1)
 
 export listApps = (prefix, getControlSocketPathFn, fetchFn, exitFn) ->
@@ -409,7 +409,7 @@ export listApps = (prefix, getControlSocketPathFn, fetchFn, exitFn) ->
     hosts = if Array.isArray(j?.hosts) then j.hosts else []
     p if hosts.length then hosts.join('\n') else '(no hosts)'
   catch e
-    console.error "rip-server: list failed: #{e?.message or e}"
+    warn "rip-server: list failed: #{e?.message or e}"
     exitFn(1)
 
 formatUptime = (seconds) ->
@@ -437,5 +437,5 @@ export showInfo = (fetchFn, exitFn) ->
     p "rip server v#{version} | #{status} | #{workers} workers | #{hosts} hosts#{upstreamPart} | uptime #{uptime}"
     exitFn(if status is 'healthy' then 0 else 1)
   catch e
-    console.error "rip-server: info failed: #{e?.message or e}"
+    warn "rip-server: info failed: #{e?.message or e}"
     exitFn(1)

package/control/lifecycle.rip

@@ -133,10 +133,10 @@ export installShutdownHandlers = (cleanup, processObj, onReload = null) ->
     processObj.on 'SIGHUP', ->
       try onReload!()
       catch err
-        console.error 'rip-server: config reload failed:', err?.message or err
+        warn 'rip-server: config reload failed:', err?.message or err
   processObj.on 'uncaughtException', (err) ->
-    console.error 'rip-server: uncaught exception:', err
+    warn 'rip-server: uncaught exception:', err
     cleanup()
   processObj.on 'unhandledRejection', (err) ->
-    console.error 'rip-server: unhandled rejection:', err
+    warn 'rip-server: unhandled rejection:', err
     cleanup()

package/control/manager.rip

@@ -73,7 +73,7 @@ export class Manager
 
     code = await proc.exited
     if code isnt 0
-      console.error "rip-server: setup exited with code #{code} for app #{app.appId}"
+      warn "rip-server: setup exited with code #{code} for app #{app.appId}"
       exit 1
 
   start: ->
@@ -208,7 +208,7 @@ export class Manager
       readyResults = Promise.all!(pairs.map((p) => @waitWorkerReady(p.replacement.socketPath, 3000)))
       allReady = readyResults.every((ready) -> ready)
       unless allReady
-        console.error "[manager] Rolling restart aborted: not all new workers ready for app #{app.appId}"
+        warn "[manager] Rolling restart aborted: not all new workers ready for app #{app.appId}"
         for pair, i in pairs
           unless readyResults[i]
             try pair.replacement.process.kill()

package/control/mdns.rip

@@ -53,4 +53,4 @@ export startMdnsAdvertisement = (host, mdnsProcesses, getLanIP, flags, formatPor
     url = "#{protocol}://#{host}#{formatPort(protocol, port)}"
     publishUrl(url)
   catch e
-    console.error "rip-server: failed to advertise #{host} via mDNS:", e.message
+    warn "rip-server: failed to advertise #{host} via mDNS:", e.message

package/control/worker.rip

@@ -15,7 +15,7 @@ export runSetupMode = ->
     if typeof fn is 'function'
       await fn()
   catch e
-    console.error "rip-server: setup failed:", e
+    warn "rip-server: setup failed:", e
     exit 1
 
 export runWorkerMode = ->
@@ -62,7 +62,7 @@ export runWorkerMode = ->
       workerState.handler = h if h
       workerState.handler or (-> new Response('not ready', { status: 503 }))
     catch e
-      console.error "[worker #{workerId}] import failed:", e
+      warn "[worker #{workerId}] import failed:", e
       workerState.handler or (-> new Response('not ready', { status: 503 }))
 
   selfJoin = ->
@@ -106,7 +106,7 @@ export runWorkerMode = ->
         res = res!(req) if typeof res is 'function'
         if res instanceof Response then res else new Response(String(res))
       catch err
-        console.error "[worker #{workerId}] ERROR:", err
+        warn "[worker #{workerId}] ERROR:", err
         new Response('error', { status: 500 })
       finally
         workerState.inflight = false
@@ -129,8 +129,8 @@ export runWorkerMode = ->
   process.on 'SIGTERM', shutdown
   process.on 'SIGINT', shutdown
   process.on 'uncaughtException', (err) ->
-    console.error "[worker #{workerId}] uncaught exception:", err
+    warn "[worker #{workerId}] uncaught exception:", err
     shutdown()
   process.on 'unhandledRejection', (err) ->
-    console.error "[worker #{workerId}] unhandled rejection:", err
+    warn "[worker #{workerId}] unhandled rejection:", err
     shutdown()

package/middleware.rip

@@ -100,7 +100,7 @@ export cors = (opts = {}) ->
 export logger = (opts = {}) ->
   format = opts.format or 'dev'
   skip = opts.skip or null
-  stream = opts.stream or { write: (msg) -> console.log msg.trim() }
+  stream = opts.stream or { write: (msg) -> p msg.trim() }
 
   formatters =
     tiny: (info) -> "#{info.method} #{info.path} #{info.status} - #{info.ms}ms"
@@ -274,7 +274,7 @@ export sessions = (opts = {}) ->
 
   # Warn if no secret in production
   if not secret and process.env.NODE_ENV is 'production'
-    console.warn 'WARNING: sessions() without secret is insecure. Set secret option for production.'
+    warn 'WARNING: sessions() without secret is insecure. Set secret option for production.'
 
   (c, next) ->
     # Parse cookie header
@@ -587,6 +587,6 @@ export serve = (opts = {}) ->
     body = JSON.stringify({ op: 'watch', prefix, dirs: watchDirs })
 
     fetch('http://localhost/watch', { method: 'POST', body, headers: { 'content-type': 'application/json' }, unix: ctl }).catch (e) ->
-      console.warn "[Rip] Watch registration failed: #{e.message}"
+      warn "[Rip] Watch registration failed: #{e.message}"
 
   (c, next) -> next!()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rip-lang/server",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Bun-native content server: static sites, apps, HTTP proxy, and TCP/TLS passthrough",
   "type": "module",
   "main": "api.rip",
@@ -47,7 +47,7 @@
   "author": "Steve Shreeve <steve.shreeve@gmail.com>",
   "license": "MIT",
   "dependencies": {
-    "rip-lang": ">=3.13.133"
+    "rip-lang": ">=3.13.134"
   },
   "files": [
     "api.rip",

package/server.rip

@@ -223,7 +223,9 @@ class Server
         return Bun.serve(Object.assign({ port, idleTimeout: 0, fetch: fetchFn }, wsOpts, opts))
       catch e
         if e?.code is 'EACCES' and port < 1024
-          port = if opts.tls then 3443 else 3000
+          fallback = if opts.tls then 3443 else 3000
+          warn "rip-server: port #{port} requires elevated privileges, falling back to #{fallback}"
+          port = fallback
           p = port
           continue
         throw e unless e?.code is 'EADDRINUSE'
@@ -422,9 +424,9 @@ class Server
       @appendReloadHistory(entry)
       if e.validationErrors
         label = 'serve.rip'
-        console.error formatConfigErrors(label, e.validationErrors)
+        warn formatConfigErrors(label, e.validationErrors)
       else
-        console.error "rip-server: failed to load active config: #{e.message or e}"
+        warn "rip-server: failed to load active config: #{e.message or e}"
       logEvent('config_loaded',
         id: attemptId
         source: source
@@ -819,7 +821,7 @@ class Server
           @releaseWorker(retry, app)
           return @buildResponse(res, req, start, workerSeconds, requestId)
     catch err
-      console.error "[server] forwardToWorker error:", err.message or err if isDebug()
+      warn "[server] forwardToWorker error:", err.message or err if isDebug()
       app.sockets = app.sockets.filter((x) -> x.socket isnt socket.socket)
       app.availableWorkers = app.availableWorkers.filter((x) -> x.socket isnt socket.socket)
       released = true
@@ -1030,13 +1032,13 @@ main = ->
           svr.internalHttpsServer?.reload({ tls: svr.tlsMaterial }) if svr.internalHttpsServer
           p "rip-acme: TLS reloaded with renewed cert for #{domain}"
         catch e
-          console.error "rip-acme: TLS reload failed after renewal: #{e.message}"
+          warn "rip-acme: TLS reload failed after renewal: #{e.message}"
     svr.acmeManager = acmeMgr
     for domain in acmeDomains
       try acmeMgr.obtainCert!(domain)
       catch e
-        console.error "rip-acme: cert obtain failed for #{domain}: #{e.message}"
-        console.error "rip-acme: will retry during renewal loop"
+        warn "rip-acme: cert obtain failed for #{domain}: #{e.message}"
+        warn "rip-acme: will retry during renewal loop"
     acmeMgr.startRenewalLoop(acmeDomains)
 
   process.env.RIP_URLS = svr.urls.join(',')  # exact URLs the Server just built

package/serving/config.rip

@@ -616,7 +616,7 @@ normalizeServeConfig = (config, baseDir) ->
     pushError(errors, 'E_UNKNOWN_KEY', key, "unknown top-level key #{key}", 'Allowed keys: version, server, proxies, apps, certs, rules, groups, hosts, streams.') unless TOP_LEVEL_KEYS.has(key)
 
   if config.edge? and not config.server?
-    console.warn "rip-server: 'edge' is deprecated in serve.rip; use 'server' instead"
+    warn "rip-server: 'edge' is deprecated in serve.rip; use 'server' instead"
   serverSettings = normalizeServerSettings(config.server or config.edge or {}, errors)
 
   proxies = {}

package/serving/forwarding.rip

@@ -123,7 +123,7 @@ export createWsPassthrough = (clientWs, upstreamUrl, protocols = []) ->
     try clientWs.close()
 
   upstream.addEventListener 'error', (err) ->
-    console.error "ws-passthrough: upstream error:", err.message or err
+    warn "ws-passthrough: upstream error:", err.message or err
     try clientWs.close()
 
   # Return object for client-side event wiring

package/serving/proxy.rip

@@ -10,7 +10,7 @@ import { toUpstreamWsUrl } from './runtime.rip'
 export proxyRouteToUpstream = (req, route, requestId, clientIp, runtime, metrics, flags, addSecurityHeaders, logAccess) ->
   upstream = getUpstream(runtime.upstreamPool, route.proxy)
   unless upstream
-    console.error "[proxy] no proxy '#{route.proxy}'" if isDebug()
+    warn "[proxy] no proxy '#{route.proxy}'" if isDebug()
     return serviceUnavailableResponse()
 
   attempt = 1
@@ -19,7 +19,7 @@ export proxyRouteToUpstream = (req, route, requestId, clientIp, runtime, metrics
   while attempt <= upstream.retry.attempts
     target = selectTarget(upstream, runtime.upstreamPool.nowFn)
     unless target
-      console.error "[proxy] no healthy target for '#{route.proxy}'" if isDebug()
+      warn "[proxy] no healthy target for '#{route.proxy}'" if isDebug()
       return serviceUnavailableResponse()
 
     markTargetBusy(target)
@@ -36,9 +36,9 @@ export proxyRouteToUpstream = (req, route, requestId, clientIp, runtime, metrics
       )
       workerSeconds = (performance.now() - t0) / 1000
       success = res.status < 500
-      console.error "[proxy] #{route.proxy} -> #{target.url} status=#{res.status} attempt=#{attempt}" if isDebug()
+      warn "[proxy] #{route.proxy} -> #{target.url} status=#{res.status} attempt=#{attempt}" if isDebug()
     catch err
-      console.error "[proxy] #{route.proxy} error: #{err.message or err}" if isDebug()
+      warn "[proxy] #{route.proxy} error: #{err.message or err}" if isDebug()
       res = serviceUnavailableResponse()
     finally
       releaseTarget(target, workerSeconds * 1000, success, runtime.upstreamPool)

package/serving/realtime.rip

@@ -139,7 +139,7 @@ export processResponse = (hub, body, clientId) ->
         clients = resolveTargets(hub, groups)
         deliverToClients(hub, clients, senders, JSON.stringify(bundle))
   catch e
-    console.error "realtime: invalid response:", e.message
+    warn "realtime: invalid response:", e.message
 
 # --- Proxy to backend ---
 
@@ -160,7 +160,7 @@ export proxyToBackend = (hub, headers, frameType, body) ->
       body: body or ''
     res.text!
   catch e
-    console.error "realtime: proxy failed:", e.message
+    warn "realtime: proxy failed:", e.message
     null
 
 # --- Binary delivery (for CRDT and raw data) ---
@@ -219,7 +219,7 @@ export proxyRealtimeToWorker = (headers, frameType, body, getSocket, releaseSock
       decompress: false
     res.text!
   catch e
-    console.error "realtime: worker proxy failed:", e.message
+    warn "realtime: worker proxy failed:", e.message
     null
   finally
     releaseSocket(sock)

package/serving/runtime.rip

@@ -86,7 +86,7 @@ export printCheckConfigResult = (loaded) ->
 export runCheckConfig = (flags) ->
   source = resolveConfigSource(flags.appEntry, flags.configPath)
   unless source?.path
-    console.error 'rip-server: no serve.rip found to validate'
+    warn 'rip-server: no serve.rip found to validate'
     exit 1
   try
     checked = checkConfigFile!(source.path)
@@ -94,7 +94,7 @@ export runCheckConfig = (flags) ->
   catch e
     if e.validationErrors
       label = 'serve.rip'
-      console.error formatConfigErrors(label, e.validationErrors)
+      warn formatConfigErrors(label, e.validationErrors)
     else
-      console.error "rip-server: config check failed: #{e.message or e}"
+      warn "rip-server: config check failed: #{e.message or e}"
     exit 1

package/serving/static.rip

@@ -189,7 +189,7 @@ export renderDirectoryListing = (reqPath, fsPath, rootName) ->
   </table>
   </div></div>
   <script>
-  !function(){var p,c,ox=14,oy=14;function mk(){if(p)return p;p=document.createElement('div');p.className='pop';p.innerHTML='<div class="pop-b"></div>';document.body.appendChild(p);return p}function show(a,e){var s=a.dataset.src;if(!s)return;var el=mk(),b=el.firstChild;b.innerHTML='';var img=new Image();img.src=s;b.appendChild(img);c=a;el.classList.add('on');place(e.clientX,e.clientY)}function hide(){c=null;if(p)p.classList.remove('on')}function place(x,y){if(!p)return;var r=p.getBoundingClientRect(),m=12,l=x+ox,t=y+oy;if(l+r.width>innerWidth-m)l=x-r.width-ox;if(t+r.height>innerHeight-m)t=innerHeight-r.height-m;if(l<m)l=m;if(t<m)t=m;p.style.left=l+'px';p.style.top=t+'px'}document.addEventListener('mouseover',function(e){var a=e.target.closest('[data-pv]');if(a)show(a,e)});document.addEventListener('mousemove',function(e){if(c)place(e.clientX,e.clientY)});document.addEventListener('mouseout',function(e){var a=e.target.closest('[data-pv]');if(a&&a===c)hide()});document.addEventListener('scroll',hide,{passive:true});document.addEventListener('keydown',function(e){if(e.key==='Escape')hide()});window.addEventListener('blur',hide)}();
+  !function(){var p,c,ox=14,oy=14;function mk(){if(p)return p;p=document.createElement('div');p.className='pop';p.innerHTML='<div class="pop-b"></div>';document.body.appendChild(p);return p}function show(a,e){var s=a.dataset.src;if(!s)return;var el=mk(),b=el.firstChild;b.innerHTML='';var img=new Image();img.src=s;b.appendChild(img);c=a;el.classList.add('on');place(e.clientX,e.clientY)}function hide(){c=null;if(p)p.classList.remove('on')}function place(x,y){if(!p)return;var r=p.getBoundingClientRect(),m=12,l=x+ox,t=y+oy;if(l+r.width>innerWidth-m)l=x-r.width-ox;if(t+r.height>innerHeight-m)t=innerHeight-r.height-m;if(l<m)l=m;if(t<m)t=m;p.style.left=l+'px';p.style.top=t+'px'}document.addEventListener('mouseover',function(e){var a=e.target.closest('[data-pv]');if(a)show(a,e)});document.addEventListener('mousemove',function(e){if(c)place(e.clientX,e.clientY)});document.addEventListener('mouseout',function(e){var a=e.target.closest('[data-pv]');if(a&&a===c)hide()});document.addEventListener('scroll',hide,{passive:true});document.addEventListener('keydown',function(e){if(e.key==='Escape')hide()});window.addEventListener('blur',hide);var dt=0;document.addEventListener('click',function(e){var a=e.target.closest('td.nm a');if(!a)return;var h=a.getAttribute('href');if(!h||h.endsWith('/'))return;e.preventDefault();clearTimeout(dt);dt=setTimeout(function(){location.href=h},250)});document.addEventListener('dblclick',function(e){var a=e.target.closest('td.nm a');if(!a)return;var h=a.getAttribute('href');if(!h||h.endsWith('/'))return;e.preventDefault();clearTimeout(dt);location.href=h+'?'})}();
   </script>
   </body>
   </html>
@@ -321,7 +321,7 @@ export renderTextFile = (filePath) ->
 
 # --- Static file serving ---
 
-INDEX_FILES = ['index.html', 'index.rip', 'index.ts', 'index.tsx', 'index.jsx', 'index.js']
+export INDEX_FILES = ['index.html', 'index.rip', 'index.ts', 'index.tsx', 'index.jsx', 'index.js']
 
 export findIndexFile = (dir) ->
   for name in INDEX_FILES
@@ -376,10 +376,11 @@ export serveStaticRoute = (req, url, route) ->
         return new Response(html, { headers: { 'content-type': 'text/html; charset=UTF-8' } })
     if stat.isFile()
       if route.browse and acceptsHtml(req)
-        if filePath.endsWith('.md')
+        viewSource = url.search is '?'
+        if filePath.endsWith('.md') and not viewSource
           html = renderMarkdown(filePath)
           return new Response(html, { headers: { 'content-type': 'text/html; charset=UTF-8' } })
-        if isTextFile(filePath)
+        if viewSource and isTextFile(filePath)
           html = renderTextFile(filePath)
           return new Response(html, { headers: { 'content-type': 'text/html; charset=UTF-8' } })
       file = Bun.file(filePath)

package/serving/tls.rip

@@ -21,7 +21,7 @@ export buildTlsArray = (defaultMaterial, certMap) ->
       key = readFileSync(certInfo.keyPath, 'utf8')
       entries.push({ serverName, cert, key, specificity: hostSpecificity(serverName) })
     catch e
-      console.error "rip-server: failed to load cert for #{serverName}: #{e.message}"
+      warn "rip-server: failed to load cert for #{serverName}: #{e.message}"
   entries.sort((a, b) -> b.specificity - a.specificity)
   result = entries.map((e) -> { serverName: e.serverName, cert: e.cert, key: e.key })
   if defaultMaterial?.cert and defaultMaterial?.key
@@ -45,7 +45,7 @@ export loadTlsMaterial = (flags, serverDir, acmeLoadCertFn) ->
       key = readFileSync(flags.keyPath, 'utf8')
       return { cert, key }
     catch
-      console.error 'Failed to read TLS cert/key from provided paths. Use http or fix paths.'
+      warn 'Failed to read TLS cert/key from provided paths. Use http or fix paths.'
       exit 2
 
   # ACME-managed cert (if domain is configured)
@@ -63,6 +63,6 @@ export loadTlsMaterial = (flags, serverDir, acmeLoadCertFn) ->
     key = readFileSync(keyPath, 'utf8')
     return { cert, key }
   catch e
-    console.error "rip-server: failed to load TLS certs from #{certsDir}: #{e.message}"
-    console.error 'Use --cert/--key to provide your own, or use http to disable TLS.'
+    warn "rip-server: failed to load TLS certs from #{certsDir}: #{e.message}"
+    warn 'Use --cert/--key to provide your own, or use http to disable TLS.'
     exit 2

package/serving/upstream.rip

@@ -233,7 +233,7 @@ export checkTargetHealth = (pool, target, fetchFn = null) ->
     updateTargetHealth(target, res.ok, pool)
     res.ok
   catch e
-    console.error "[health] #{url} failed: #{e?.message or e}" if process.env.RIP_DEBUG?
+    warn "[health] #{url} failed: #{e?.message or e}" if process.env.RIP_DEBUG?
     target.lastStatus = null
     updateTargetHealth(target, false, pool)
     false

package/streams/index.rip

@@ -273,12 +273,32 @@ export startStreamListeners = (runtime, options = {}) ->
       handshakeMs: Math.max(...portRoutes.map((route) -> route.timeouts?.handshakeMs or 5000), 5000)
       idleMs: Math.max(...portRoutes.map((route) -> route.timeouts?.idleMs or 300000), 300000)
       connectMs: Math.max(...portRoutes.map((route) -> route.timeouts?.connectMs or 5000), 5000)
-    listener = Bun.listen
-      hostname: options.hostname or '0.0.0.0'
-      port: port
-      allowHalfOpen: true
-      socket: createClientHandlers(runtime, port, listenerTimeouts, options).socket
-    runtime.listeners.set(port, listener)
+    try
+      listener = Bun.listen
+        hostname: options.hostname or '0.0.0.0'
+        port: port
+        allowHalfOpen: true
+        socket: createClientHandlers(runtime, port, listenerTimeouts, options).socket
+      runtime.listeners.set(port, listener)
+    catch e
+      if e?.code is 'EACCES' and port < 1024
+        warn ""
+        warn "rip-server: cannot bind to port #{port} — permission denied"
+        warn ""
+        warn "  Ports below 1024 require elevated privileges."
+        warn "  This commonly happens after upgrading Bun, which resets capabilities."
+        warn ""
+        warn "  Options:"
+        warn ""
+        warn "    1. Grant Bun the capability (recommended, one-time):"
+        warn "       sudo setcap cap_net_bind_service=+ep $(which bun)"
+        warn ""
+        warn "    2. Run with sudo:"
+        warn "       sudo rip server --file serve.rip"
+        warn ""
+        warn "  Note: upgrading Bun resets the capability — re-run setcap after upgrades."
+        warn ""
+      throw e
   runtime
 
 export stopStreamListeners = (runtime, closeActiveConnections = false) ->