locadot 1.6.0-beta.0 → 1.6.0-beta.2

package/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-The version in `package.json` is still 1.5.7. The owner decides the bump. **2.0.0** is suggested because of the
+The version in `package.json` is 1.6.0-beta.2 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
 breaking items below.
 
 ### Breaking
@@ -28,6 +28,9 @@ breaking items below.
 - Test suite (`pnpm test`) and a `prepublishOnly` build.
 
 ### Fixed
+- Windows: `startup:enable` no longer needs admin rights. It used to fail with "Access is denied". Start at logon now uses the user's Startup folder instead of a scheduled task. (BUG-14)
+- Windows: console windows no longer flash up from the background proxy's `certutil`/`schtasks` checks. Start at logon now runs hidden and writes to the log. (BUG-13)
+- Upstream `Connection`/`Upgrade` headers are no longer forwarded. Apache sites proxied through locadot kept dropping the connection and lost assets. (BUG-12)
 - `stop`, `restart` and `kill` now actually stop the proxy. (BUG-01)
 - A failed start is reported with the log tail and exits 1. (BUG-07)
 - `update` accepts http targets and `add` accepts https ones. (BUG-03)

package/README.md

@@ -82,7 +82,7 @@ Options for `add` / `update`:
 | `locadot clear:logs` | Clear the log file. |
 | `locadot path` | Show every file locadot uses. `path:logs` and `path:hosts` print a single path. |
 | `locadot token` | Print the dashboard API token, for scripts and AI agents. |
-| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (Windows scheduled task). |
+| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (a hidden script in the Windows Startup folder, no admin needed). |
 
 ---
 

package/dist/lib/commands.js

@@ -280,6 +280,7 @@ class Commands {
                 ? ["open", [url]]
                 : ["xdg-open", [url]];
         try {
+            // windows-hide-exempt: run from the user's terminal (no popup), and hiding `cmd /c start` can hide the browser too.
             (0, child_process_1.spawn)(command, args, { detached: true, stdio: "ignore" }).on("error", () => { }).unref();
         }
         catch { }

package/dist/lib/system.js

@@ -46,7 +46,7 @@ const canBindPrivileged = () => {
     return start !== null && start <= Math.min(constants_1.default.server.httpPort, constants_1.default.server.httpsPort);
 };
 exports.canBindPrivileged = canBindPrivileged;
-// Startup.info shells out (crontab/schtasks); don't do that on every 5 s dashboard poll.
+// Startup.info may shell out (crontab); don't do that on every 5 s dashboard poll.
 const STARTUP_TTL_MS = 30000;
 let startupCache;
 const invalidateSystemStatus = () => {

package/dist/server.js

@@ -65,6 +65,20 @@ async function startCentralProxy() {
     const stats = new Map();
     const proxy = http_proxy_1.default.createProxyServer({});
     proxy.on("error", (err) => logger_1.default.warn(`proxy error: ${err.message}`));
+    // Hop-by-hop headers describe the upstream connection, not ours. Apache sends
+    // `Connection: Upgrade, close` + `Upgrade: h2`, which made us close the browser's
+    // socket after every response (ERR_TOO_MANY_RETRIES on asset-heavy pages).
+    proxy.on("proxyRes", (proxyRes) => {
+        if (proxyRes.statusCode === 101)
+            return;
+        const listed = String(proxyRes.headers.connection || "")
+            .split(",")
+            .map((name) => name.trim().toLowerCase())
+            .filter(Boolean);
+        for (const name of [...listed, "connection", "keep-alive", "upgrade", "proxy-connection"]) {
+            delete proxyRes.headers[name];
+        }
+    });
     const info = {
         pid: process.pid,
         version: package_json_1.version,

package/dist/utils/startup.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsLauncherScript = void 0;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_1 = __importDefault(require("fs"));
@@ -15,6 +16,10 @@ const SERVICE_NAME = "locadot-proxy";
 const MAC_LABEL = "com.locadot.proxy";
 const CRON_MARK = "# locadot-proxy";
 const MARKER = path_1.default.join(constants_1.default.paths.HOME, "startup.json");
+// Per-user Startup folder: unlike an ONLOGON scheduled task it needs no admin rights.
+const windowsLauncher = () => path_1.default.join(process.env.APPDATA || path_1.default.join(os_1.default.homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup", `${SERVICE_NAME}.vbs`);
+// Earlier versions registered an ONLOGON scheduled task and kept the script in the state dir.
+const LEGACY_LAUNCHER = path_1.default.join(constants_1.default.paths.HOME, "startup-hidden.vbs");
 const plistPath = () => path_1.default.join(os_1.default.homedir(), "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
 const quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 // Resolved on use, not import: the entry path depends on how locadot was launched.
@@ -22,6 +27,25 @@ const launchArgs = () => {
     const { command, path: args } = locadot_file_1.default.getStartProxyFile();
     return { command, args: [...args, "--home", constants_1.default.paths.HOME] };
 };
+/**
+ * Launching node.exe directly at logon opens a console window, and closing it kills the
+ * proxy. Explorer runs the .vbs with wscript, which has no console, and Run(…, 0) keeps cmd
+ * and node hidden too. cmd also appends the output to the log, like the cron line does.
+ */
+const windowsLauncherScript = (command, args) => {
+    const env = `set LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort}&& set LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort}&&`;
+    const line = `cmd /d /c ${env} ${[command, ...args].map((a) => `"${a}"`).join(" ")} >> "${constants_1.default.paths.LOGS}" 2>&1`;
+    return `CreateObject("WScript.Shell").Run "${line.replace(/"/g, '""')}", 0, False\r\n`;
+};
+exports.windowsLauncherScript = windowsLauncherScript;
+/** Best effort: deleting a task the user created without elevation needs none. */
+const removeLegacyTask = () => {
+    try {
+        (0, child_process_1.execFileSync)("schtasks", ["/Delete", "/TN", SERVICE_NAME, "/F"], { stdio: "ignore", windowsHide: true });
+    }
+    catch { }
+    fs_1.default.rmSync(LEGACY_LAUNCHER, { force: true });
+};
 function execSudo(cmd) {
     return new Promise((resolve, reject) => {
         sudo_prompt_1.default.exec(cmd, { name: "Locadot" }, (error, stdout, stderr) => {
@@ -56,10 +80,11 @@ class Startup {
         let method = "";
         switch (platform) {
             case "windows": {
-                // Per-user logon task: keeps the user's app-data dir; ports 80/443 need no elevation on Windows.
-                const tr = [command, ...args].map((a) => `"${a}"`).join(" ");
-                (0, child_process_1.execFileSync)("schtasks", ["/Create", "/TN", SERVICE_NAME, "/TR", tr, "/SC", "ONLOGON", "/F"], { stdio: "inherit" });
-                method = "schtasks";
+                // Runs at the user's logon; ports 80/443 need no elevation on Windows.
+                removeLegacyTask();
+                fs_1.default.mkdirSync(path_1.default.dirname(windowsLauncher()), { recursive: true });
+                fs_1.default.writeFileSync(windowsLauncher(), (0, exports.windowsLauncherScript)(command, args));
+                method = "startup-folder";
                 break;
             }
             case "linux": {
@@ -71,7 +96,7 @@ class Startup {
                     method = "root-crontab";
                 }
                 else {
-                    (0, child_process_1.execFileSync)("sh", ["-c", edit], { stdio: "inherit" });
+                    (0, child_process_1.execFileSync)("sh", ["-c", edit], { stdio: "inherit", windowsHide: true });
                     method = "user-crontab";
                 }
                 break;
@@ -98,7 +123,7 @@ class Startup {
 </plist>`;
                 fs_1.default.mkdirSync(path_1.default.dirname(plistPath()), { recursive: true });
                 fs_1.default.writeFileSync(plistPath(), plist);
-                (0, child_process_1.execFileSync)("launchctl", ["load", "-w", plistPath()], { stdio: "inherit" });
+                (0, child_process_1.execFileSync)("launchctl", ["load", "-w", plistPath()], { stdio: "inherit", windowsHide: true });
                 method = "launch-agent";
                 break;
             }
@@ -114,21 +139,19 @@ class Startup {
         const method = Startup.marker()?.method;
         switch (platform) {
             case "windows":
-                try {
-                    (0, child_process_1.execFileSync)("schtasks", ["/Delete", "/TN", SERVICE_NAME, "/F"], { stdio: "ignore" });
-                }
-                catch { }
+                removeLegacyTask();
+                fs_1.default.rmSync(windowsLauncher(), { force: true });
                 break;
             case "linux":
                 if (method === "root-crontab")
                     await execSudo(`sh -c ${quote(cronEdit())}`);
                 else
-                    (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit" });
+                    (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit", windowsHide: true });
                 break;
             case "mac":
                 if (fs_1.default.existsSync(plistPath())) {
                     try {
-                        (0, child_process_1.execFileSync)("launchctl", ["unload", "-w", plistPath()], { stdio: "ignore" });
+                        (0, child_process_1.execFileSync)("launchctl", ["unload", "-w", plistPath()], { stdio: "ignore", windowsHide: true });
                     }
                     catch { }
                     fs_1.default.rmSync(plistPath(), { force: true });
@@ -163,12 +186,11 @@ class Startup {
                 case "linux":
                     if (marker?.method === "root-crontab")
                         return true;
-                    return (0, child_process_1.execFileSync)("sh", ["-c", "crontab -l 2>/dev/null || true"], { encoding: "utf8" }).includes(CRON_MARK);
+                    return (0, child_process_1.execFileSync)("sh", ["-c", "crontab -l 2>/dev/null || true"], { encoding: "utf8", windowsHide: true }).includes(CRON_MARK);
                 case "mac":
                     return fs_1.default.existsSync(plistPath());
                 case "windows":
-                    (0, child_process_1.execFileSync)("schtasks", ["/Query", "/TN", SERVICE_NAME], { stdio: "ignore" });
-                    return true;
+                    return fs_1.default.existsSync(windowsLauncher());
                 default:
                     return false;
             }

package/dist/utils/trust.js

@@ -32,7 +32,7 @@ function execSudo(cmd) {
 }
 function hasBinary(bin) {
     try {
-        (0, child_process_1.execSync)(`command -v ${bin}`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`command -v ${bin}`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {
@@ -75,6 +75,7 @@ function trustNssDbs(certPath) {
         try {
             (0, child_process_1.execSync)(`certutil -d "${db}" -A -t "C,," -n "${CA_NAME}" -i "${certPath}"`, {
                 stdio: "ignore",
+                windowsHide: true,
             });
         }
         catch {
@@ -87,7 +88,7 @@ function untrustNssDbs() {
         return;
     for (const db of nssProfileDirs()) {
         try {
-            (0, child_process_1.execSync)(`certutil -d "${db}" -D -n "${CA_NAME}"`, { stdio: "ignore" });
+            (0, child_process_1.execSync)(`certutil -d "${db}" -D -n "${CA_NAME}"`, { stdio: "ignore", windowsHide: true });
         }
         catch {
             // Not present in this profile — nothing to remove.
@@ -133,7 +134,7 @@ async function untrustMac() {
 }
 function isTrustedMac(certPath) {
     try {
-        (0, child_process_1.execSync)(`security verify-cert -c "${certPath}"`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`security verify-cert -c "${certPath}"`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {
@@ -148,7 +149,7 @@ async function untrustWindows() {
 }
 function isTrustedWindows() {
     try {
-        (0, child_process_1.execSync)(`certutil -store Root "${CA_NAME}"`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`certutil -store Root "${CA_NAME}"`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "1.6.0-beta.0",
+  "version": "1.6.0-beta.2",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",