locadot 1.6.0-beta.1 → 1.6.0-beta.3

package/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-The version in `package.json` is still 1.5.7. The owner decides the bump. **2.0.0** is suggested because of the
+The version in `package.json` is 1.6.0-beta.3 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
 breaking items below.
 
 ### Breaking
@@ -13,6 +13,7 @@ breaking items below.
 - Bare `localhost` is reserved for the dashboard and can't be mapped.
 
 ### Added
+- `--cors` per mapping (CLI, API and dashboard). `Origin`/`Referer` are sent as the target's own origin, CORS preflights are answered locally, and any origin may call the domain with credentials. (ENH-12)
 - A control panel at `https://localhost` with a dark theme. You can add, edit and remove mappings, toggle CA trust and start-at-boot, see root/admin and privileged-port status,
   tail and clear logs, and stop the proxy. (FEAT-05)
 - A token-protected JSON API for scripts and AI agents (`POST/PUT/DELETE /api/hosts`, `/api/startup`, `/api/trust`, `/api/logs`, `/api/proxy/stop`),
@@ -28,6 +29,8 @@ breaking items below.
 - Test suite (`pnpm test`) and a `prepublishOnly` build.
 
 ### Fixed
+- Windows: `startup:enable` no longer needs admin rights. It used to fail with "Access is denied". Start at logon now uses the user's Startup folder instead of a scheduled task. (BUG-14)
+- Windows: console windows no longer flash up from the background proxy's `certutil`/`schtasks` checks. Start at logon now runs hidden and writes to the log. (BUG-13)
 - Upstream `Connection`/`Upgrade` headers are no longer forwarded. Apache sites proxied through locadot kept dropping the connection and lost assets. (BUG-12)
 - `stop`, `restart` and `kill` now actually stop the proxy. (BUG-01)
 - A failed start is reported with the log tail and exits 1. (BUG-07)

package/README.md

@@ -54,6 +54,7 @@ Options for `add` / `update`:
 | `-p, --port <port>` | Shorthand for `--target http://localhost:<port>`. |
 | `-t, --target <url>` | Any http(s) upstream. A bare `host:port` means `http://host:port`. |
 | `-k, --insecure` | Don't verify the TLS certificate of an `https` target (self-signed upstreams). |
+| `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. URLs hard-coded in pages still go to the real domain. |
 | `--no-start` | Save the mapping without starting the proxy. |
 
 ### Proxy
@@ -82,7 +83,7 @@ Options for `add` / `update`:
 | `locadot clear:logs` | Clear the log file. |
 | `locadot path` | Show every file locadot uses. `path:logs` and `path:hosts` print a single path. |
 | `locadot token` | Print the dashboard API token, for scripts and AI agents. |
-| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (Windows scheduled task). |
+| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (a hidden script in the Windows Startup folder, no admin needed). |
 
 ---
 
@@ -93,7 +94,7 @@ are answered by locadot itself, not proxied. The page is a dark control panel:
 
 - **System:** whether the proxy runs as root/admin, whether ports below 1024 can be bound (with the Linux sysctl fix when they
   can't), CA trust with an on/off toggle, start-at-boot with an on/off toggle, ports, bind addresses and state dir. It also has a **Stop proxy** button.
-- **Proxies:** add a mapping (host + port / host:port / URL, and an optional "insecure TLS" box), edit a target inline, or remove one. The table shows
+- **Proxies:** add a mapping (host + port / host:port / URL, and optional "Insecure TLS" and "Bypass CORS" boxes), edit a target inline, or remove one. The table shows
   each source → destination with up/down, status, latency, hits, errors, last access and average ms. It refreshes every 5 s.
 - **Logs:** a live tail with refresh and clear.
 - **CLI / API snippets** you can copy.
@@ -113,8 +114,8 @@ each time the proxy starts.
 | `GET /api/status` | | Proxy info, uptime, host count, and `system` (`platform`, `isRoot`, `canBindPrivileged`, `unprivilegedPortStart`, `caTrusted`, `startup`, `stateDir`). |
 | `GET /api/hosts` | | Every mapping with urls, probe (`up`, `status`, `ms`) and stats. |
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
-| `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false }` | Add a mapping (201; 409 if it exists). |
-| `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false }` | Change a mapping (404 if unknown). |
+| `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
+| `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
 | `DELETE /api/hosts/:host` | | Remove a mapping. |
 | `POST /api/startup` | `{ "enabled": true }` | Start at boot on/off. |
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |

package/dist/dashboard/api.js

@@ -165,7 +165,7 @@ async function route(req, url, ctx) {
     const body = await readJson(req);
     try {
         if (path === "/api/hosts") {
-            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure") });
+            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
             return { status: 201, body: { ok: true, host, ...entry, url: hostUrl(host, ctx) } };
@@ -178,7 +178,7 @@ async function route(req, url, ctx) {
                 logger_1.default.info(`🗑️ dashboard: removed ${host}`);
                 return { status: 200, body: { ok: true, host } };
             }
-            const updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure") });
+            const updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
             ctx.reload();
             logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             return { status: 200, body: { ok: true, host: updated.host, ...updated.entry, url: hostUrl(updated.host, ctx) } };

package/dist/dashboard/index.js

@@ -42,6 +42,7 @@ async function buildHosts(ctx) {
             host,
             target: entry.target,
             insecure: !!entry.insecure,
+            cors: !!entry.cors,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),

package/dist/dashboard/page.js

@@ -305,6 +305,9 @@ tr:last-child td { border-bottom: none; }
   width: 100%;
   min-width: 160px;
 }
+.badges { display: flex; flex-wrap: wrap; gap: 4px; }
+.badge-cors { color: var(--accent-cyan); border-color: var(--accent-cyan); background: rgba(34, 211, 238, 0.1); }
+td .inline-check + .inline-check { margin-top: 4px; }
 .inline-check { display: flex; align-items: center; gap: 6px; font-size: 12px; color: var(--muted); }
 .dim { color: var(--muted-dim); }
 
@@ -449,6 +452,7 @@ const clientJs = `
   var addHostInput = document.getElementById("add-host");
   var addTargetInput = document.getElementById("add-target");
   var addInsecureInput = document.getElementById("add-insecure");
+  var addCorsInput = document.getElementById("add-cors");
   var addSubmitBtn = document.getElementById("add-submit");
   var addErrorEl = document.getElementById("add-error");
 
@@ -757,9 +761,10 @@ const clientJs = `
     }
     if (hostVal.indexOf(".") === -1) hostVal = hostVal + ".localhost";
     var insecureVal = !!addInsecureInput.checked;
+    var corsVal = !!addCorsInput.checked;
     addSubmitBtn.disabled = true;
     addSubmitBtn.classList.add("busy");
-    apiFetch("/api/hosts", { method: "POST", body: JSON.stringify({ host: hostVal, target: targetVal, insecure: insecureVal }) })
+    apiFetch("/api/hosts", { method: "POST", body: JSON.stringify({ host: hostVal, target: targetVal, insecure: insecureVal, cors: corsVal }) })
       .then(function () {
         addForm.reset();
         showToast("Added " + hostVal, "success");
@@ -822,17 +827,24 @@ const clientJs = `
     tr.appendChild(makeCell("\\u2192", "arrow"));
     tr.appendChild(makeCell(row.target, "mono"));
 
-    var insecureTd = document.createElement("td");
-    if (row.insecure) {
-      var badge = document.createElement("span");
-      badge.className = "badge";
-      badge.textContent = "insecure";
-      insecureTd.appendChild(badge);
+    var optionsTd = document.createElement("td");
+    var flags = [];
+    if (row.insecure) flags.push(["insecure", "Upstream TLS certificate is not verified"]);
+    if (row.cors) flags.push(["cors", "Origin/Referer rewritten to the target; any origin may call this host"]);
+    if (flags.length) {
+      optionsTd.className = "badges";
+      flags.forEach(function (flag) {
+        var badge = document.createElement("span");
+        badge.className = "badge" + (flag[0] === "cors" ? " badge-cors" : "");
+        badge.textContent = flag[0];
+        badge.title = flag[1];
+        optionsTd.appendChild(badge);
+      });
     } else {
-      insecureTd.className = "dim";
-      insecureTd.textContent = "\\u2014";
+      optionsTd.className = "dim";
+      optionsTd.textContent = "\\u2014";
     }
-    tr.appendChild(insecureTd);
+    tr.appendChild(optionsTd);
 
     var statusTd = document.createElement("td");
     statusTd.appendChild(statusPill(row));
@@ -899,6 +911,14 @@ const clientJs = `
     insecureLabel.appendChild(insecureInput);
     insecureLabel.appendChild(document.createTextNode("insecure"));
     insecureTd.appendChild(insecureLabel);
+    var corsLabel = document.createElement("label");
+    corsLabel.className = "inline-check";
+    var corsInput = document.createElement("input");
+    corsInput.type = "checkbox";
+    corsInput.checked = !!row.cors;
+    corsLabel.appendChild(corsInput);
+    corsLabel.appendChild(document.createTextNode("cors"));
+    insecureTd.appendChild(corsLabel);
     tr.appendChild(insecureTd);
 
     tr.appendChild(makeCell("\\u2014", "dim"));
@@ -927,7 +947,7 @@ const clientJs = `
       cancelBtn.disabled = true;
       apiFetch("/api/hosts/" + encodeURIComponent(row.host), {
         method: "PUT",
-        body: JSON.stringify({ target: newTarget, insecure: !!insecureInput.checked })
+        body: JSON.stringify({ target: newTarget, insecure: !!insecureInput.checked, cors: !!corsInput.checked })
       })
         .then(function () {
           editingHost = null;
@@ -1134,6 +1154,10 @@ function renderPage(nonce, token) {
           <input type="checkbox" id="add-insecure" name="insecure">
           <label for="add-insecure">Insecure TLS</label>
         </div>
+        <div class="field field-checkbox" title="Send Origin/Referer as the target's own and let any origin call this host">
+          <input type="checkbox" id="add-cors" name="cors">
+          <label for="add-cors">Bypass CORS</label>
+        </div>
         <button type="submit" id="add-submit" class="btn btn-primary">Add proxy</button>
       </div>
       <div id="add-error" class="field-error" role="alert" hidden></div>
@@ -1153,7 +1177,7 @@ function renderPage(nonce, token) {
             <th scope="col">Host</th>
             <th scope="col" class="visually-hidden">Flow</th>
             <th scope="col">Target</th>
-            <th scope="col">Insecure</th>
+            <th scope="col">Options</th>
             <th scope="col">Status</th>
             <th scope="col">Hits</th>
             <th scope="col">Errors</th>

package/dist/index.js

@@ -30,6 +30,8 @@ const destinationOptions = (command) => command
     .option("-p, --port <port>", "Local port to forward to (shorthand for --target http://localhost:<port>)")
     .option("-t, --target <url>", "Any upstream: 3000, 127.0.0.1:8080, http://192.168.1.5:8080, https://google.com")
     .option("-k, --insecure", "Don't verify the TLS certificate of an https target")
+    .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
+    .option("--no-cors", "Turn --cors off again (update)")
     .option("--no-start", "Only save the mapping; don't start the proxy");
 program
     .name("locadot")

package/dist/lib/commands.js

@@ -90,7 +90,7 @@ const warnIfDown = async (entry) => {
 };
 class Commands {
     static async add(options) {
-        const { host, entry } = await hosts_1.default.add({ host: options.host, target: resolveTarget(options), insecure: options.insecure });
+        const { host, entry } = await hosts_1.default.add({ host: options.host, target: resolveTarget(options), insecure: options.insecure, cors: options.cors });
         const { target } = entry;
         await ensureRunning(options);
         print(`✅ ${(0, exports.urlFor)(host)} → ${target}`);
@@ -100,7 +100,7 @@ class Commands {
         await warnIfDown(entry);
     }
     static async update(options) {
-        const { host, entry } = await hosts_1.default.update({ host: options.host, target: resolveTarget(options), insecure: options.insecure });
+        const { host, entry } = await hosts_1.default.update({ host: options.host, target: resolveTarget(options), insecure: options.insecure, cors: options.cors });
         const { target } = entry;
         await ensureRunning(options);
         print(`✅ Updated ${(0, exports.urlFor)(host)} → ${target}`);
@@ -122,7 +122,7 @@ class Commands {
         }
         const width = Math.max(...hosts.map(([host]) => (0, exports.urlFor)(host).length));
         for (const [host, entry] of hosts) {
-            print(`${(0, exports.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}`);
+            print(`${(0, exports.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}`);
         }
         print(`☑️ Total: ${hosts.length}.`);
     }
@@ -280,6 +280,7 @@ class Commands {
                 ? ["open", [url]]
                 : ["xdg-open", [url]];
         try {
+            // windows-hide-exempt: run from the user's terminal (no popup), and hiding `cmd /c start` can hide the browser too.
             (0, child_process_1.spawn)(command, args, { detached: true, stdio: "ignore" }).on("error", () => { }).unref();
         }
         catch { }

package/dist/lib/hosts.js

@@ -69,7 +69,7 @@ class HostOps {
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -82,7 +82,8 @@ class HostOps {
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             const insecure = input.insecure ?? existing.insecure;
-            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, updatedAt: new Date().toISOString() };
+            const cors = input.cors ?? existing.cors;
+            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, cors: cors || undefined, updatedAt: new Date().toISOString() };
             return registry.hosts[host];
         });
         return { host, entry };

package/dist/lib/http.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hostOf = void 0;
+exports.applyCors = exports.hostOf = void 0;
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
@@ -34,8 +34,54 @@ const proxyOptions = (req, entry) => ({
     hostRewrite: req.headers.host,
     protocolRewrite: isTls(req) ? "https" : "http",
     cookieDomainRewrite: { "*": "" },
-    headers: { "X-Original-Host": req.headers.host || "" },
+    headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? sameOriginHeaders(req, entry) : {}) },
 });
+// --cors: the upstream should see a request from its own site, so origin/CSRF checks pass.
+const sameOriginHeaders = (req, entry) => {
+    const origin = new URL(entry.target).origin;
+    const headers = {};
+    if (req.headers.origin)
+        headers.Origin = origin;
+    if (req.headers.referer) {
+        try {
+            const referer = new URL(req.headers.referer);
+            headers.Referer = origin + referer.pathname + referer.search;
+        }
+        catch {
+            headers.Referer = origin + "/";
+        }
+    }
+    return headers;
+};
+const isPreflight = (req) => req.method === "OPTIONS" && !!req.headers.origin && !!req.headers["access-control-request-method"];
+/** Headers that let the calling page read the response, credentials included. */
+const allowOrigin = (req) => req.headers.origin
+    ? { "Access-Control-Allow-Origin": req.headers.origin, "Access-Control-Allow-Credentials": "true", Vary: "Origin" }
+    : { "Access-Control-Allow-Origin": "*" };
+/**
+ * Rewrites an upstream response for a --cors host: our CORS headers replace the upstream's,
+ * and cookies become SameSite=None so a page on another origin can send them back.
+ */
+const applyCors = (req, headers) => {
+    for (const name of Object.keys(headers)) {
+        if (name.startsWith("access-control-"))
+            delete headers[name];
+    }
+    const exposed = Object.keys(headers).filter((name) => name !== "set-cookie" && name !== "vary");
+    headers["access-control-allow-origin"] = req.headers.origin || "*";
+    if (req.headers.origin) {
+        headers["access-control-allow-credentials"] = "true";
+        const vary = String(headers.vary || "");
+        if (!/(^|,)\s*(origin|\*)\s*(,|$)/i.test(vary))
+            headers.vary = vary ? `${vary}, Origin` : "Origin";
+    }
+    if (exposed.length)
+        headers["access-control-expose-headers"] = exposed.join(", ");
+    if (isTls(req) && headers["set-cookie"]) {
+        headers["set-cookie"] = headers["set-cookie"].map((cookie) => cookie.replace(/;\s*samesite=[^;]*/gi, "").replace(/;\s*secure\b(?!=)/gi, "") + "; SameSite=None; Secure");
+    }
+};
+exports.applyCors = applyCors;
 const record = (stats, host, status, ms, error) => {
     const current = stats.get(host) || { hits: 0, errors: 0 };
     current.hits += 1;
@@ -60,6 +106,20 @@ class HttpModule {
                 res.end((0, template_1.proxyNotFound)(host, dashboardUrl(req)));
                 return;
             }
+            // Answered here: upstreams often reject OPTIONS or don't send the headers the browser wants.
+            if (entry.cors && isPreflight(req)) {
+                const requested = req.headers["access-control-request-headers"];
+                res.writeHead(204, {
+                    ...allowOrigin(req),
+                    "Access-Control-Allow-Methods": String(req.headers["access-control-request-method"]),
+                    ...(requested ? { "Access-Control-Allow-Headers": String(requested) } : {}),
+                    ...(req.headers["access-control-request-private-network"] ? { "Access-Control-Allow-Private-Network": "true" } : {}),
+                    "Access-Control-Max-Age": "600",
+                    "Content-Length": "0",
+                });
+                res.end();
+                return;
+            }
             const started = Date.now();
             res.once("finish", () => {
                 record(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500);
@@ -70,7 +130,8 @@ class HttpModule {
                     res.destroy();
                     return;
                 }
-                res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+                // With --cors the page should see a 502, not a CORS error.
+                res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? allowOrigin(req) : {}) });
                 res.end((0, template_1.upstreamDown)(host, entry.target, err?.code || err?.message || "error", dashboardUrl(req)));
             });
         }

package/dist/lib/system.js

@@ -46,7 +46,7 @@ const canBindPrivileged = () => {
     return start !== null && start <= Math.min(constants_1.default.server.httpPort, constants_1.default.server.httpsPort);
 };
 exports.canBindPrivileged = canBindPrivileged;
-// Startup.info shells out (crontab/schtasks); don't do that on every 5 s dashboard poll.
+// Startup.info may shell out (crontab); don't do that on every 5 s dashboard poll.
 const STARTUP_TTL_MS = 30000;
 let startupCache;
 const invalidateSystemStatus = () => {

package/dist/server.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -12,7 +45,7 @@ const http_proxy_1 = __importDefault(require("http-proxy"));
 const constants_1 = __importDefault(require("./constants"));
 const registry_1 = __importDefault(require("./lib/registry"));
 const locadot_file_1 = __importDefault(require("./lib/locadot-file"));
-const http_2 = __importDefault(require("./lib/http"));
+const http_2 = __importStar(require("./lib/http"));
 const localhost_1 = __importDefault(require("./lib/localhost"));
 const file_1 = __importDefault(require("./utils/file"));
 const logger_1 = __importDefault(require("./utils/logger"));
@@ -68,7 +101,7 @@ async function startCentralProxy() {
     // Hop-by-hop headers describe the upstream connection, not ours. Apache sends
     // `Connection: Upgrade, close` + `Upgrade: h2`, which made us close the browser's
     // socket after every response (ERR_TOO_MANY_RETRIES on asset-heavy pages).
-    proxy.on("proxyRes", (proxyRes) => {
+    proxy.on("proxyRes", (proxyRes, req) => {
         if (proxyRes.statusCode === 101)
             return;
         const listed = String(proxyRes.headers.connection || "")
@@ -78,6 +111,8 @@ async function startCentralProxy() {
         for (const name of [...listed, "connection", "keep-alive", "upgrade", "proxy-connection"]) {
             delete proxyRes.headers[name];
         }
+        if (registry.hosts[(0, http_2.hostOf)(req)]?.cors)
+            (0, http_2.applyCors)(req, proxyRes.headers);
     });
     const info = {
         pid: process.pid,

package/dist/utils/startup.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsLauncherScript = void 0;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_1 = __importDefault(require("fs"));
@@ -15,6 +16,10 @@ const SERVICE_NAME = "locadot-proxy";
 const MAC_LABEL = "com.locadot.proxy";
 const CRON_MARK = "# locadot-proxy";
 const MARKER = path_1.default.join(constants_1.default.paths.HOME, "startup.json");
+// Per-user Startup folder: unlike an ONLOGON scheduled task it needs no admin rights.
+const windowsLauncher = () => path_1.default.join(process.env.APPDATA || path_1.default.join(os_1.default.homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup", `${SERVICE_NAME}.vbs`);
+// Earlier versions registered an ONLOGON scheduled task and kept the script in the state dir.
+const LEGACY_LAUNCHER = path_1.default.join(constants_1.default.paths.HOME, "startup-hidden.vbs");
 const plistPath = () => path_1.default.join(os_1.default.homedir(), "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
 const quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 // Resolved on use, not import: the entry path depends on how locadot was launched.
@@ -22,6 +27,25 @@ const launchArgs = () => {
     const { command, path: args } = locadot_file_1.default.getStartProxyFile();
     return { command, args: [...args, "--home", constants_1.default.paths.HOME] };
 };
+/**
+ * Launching node.exe directly at logon opens a console window, and closing it kills the
+ * proxy. Explorer runs the .vbs with wscript, which has no console, and Run(…, 0) keeps cmd
+ * and node hidden too. cmd also appends the output to the log, like the cron line does.
+ */
+const windowsLauncherScript = (command, args) => {
+    const env = `set LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort}&& set LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort}&&`;
+    const line = `cmd /d /c ${env} ${[command, ...args].map((a) => `"${a}"`).join(" ")} >> "${constants_1.default.paths.LOGS}" 2>&1`;
+    return `CreateObject("WScript.Shell").Run "${line.replace(/"/g, '""')}", 0, False\r\n`;
+};
+exports.windowsLauncherScript = windowsLauncherScript;
+/** Best effort: deleting a task the user created without elevation needs none. */
+const removeLegacyTask = () => {
+    try {
+        (0, child_process_1.execFileSync)("schtasks", ["/Delete", "/TN", SERVICE_NAME, "/F"], { stdio: "ignore", windowsHide: true });
+    }
+    catch { }
+    fs_1.default.rmSync(LEGACY_LAUNCHER, { force: true });
+};
 function execSudo(cmd) {
     return new Promise((resolve, reject) => {
         sudo_prompt_1.default.exec(cmd, { name: "Locadot" }, (error, stdout, stderr) => {
@@ -56,10 +80,11 @@ class Startup {
         let method = "";
         switch (platform) {
             case "windows": {
-                // Per-user logon task: keeps the user's app-data dir; ports 80/443 need no elevation on Windows.
-                const tr = [command, ...args].map((a) => `"${a}"`).join(" ");
-                (0, child_process_1.execFileSync)("schtasks", ["/Create", "/TN", SERVICE_NAME, "/TR", tr, "/SC", "ONLOGON", "/F"], { stdio: "inherit" });
-                method = "schtasks";
+                // Runs at the user's logon; ports 80/443 need no elevation on Windows.
+                removeLegacyTask();
+                fs_1.default.mkdirSync(path_1.default.dirname(windowsLauncher()), { recursive: true });
+                fs_1.default.writeFileSync(windowsLauncher(), (0, exports.windowsLauncherScript)(command, args));
+                method = "startup-folder";
                 break;
             }
             case "linux": {
@@ -71,7 +96,7 @@ class Startup {
                     method = "root-crontab";
                 }
                 else {
-                    (0, child_process_1.execFileSync)("sh", ["-c", edit], { stdio: "inherit" });
+                    (0, child_process_1.execFileSync)("sh", ["-c", edit], { stdio: "inherit", windowsHide: true });
                     method = "user-crontab";
                 }
                 break;
@@ -98,7 +123,7 @@ class Startup {
 </plist>`;
                 fs_1.default.mkdirSync(path_1.default.dirname(plistPath()), { recursive: true });
                 fs_1.default.writeFileSync(plistPath(), plist);
-                (0, child_process_1.execFileSync)("launchctl", ["load", "-w", plistPath()], { stdio: "inherit" });
+                (0, child_process_1.execFileSync)("launchctl", ["load", "-w", plistPath()], { stdio: "inherit", windowsHide: true });
                 method = "launch-agent";
                 break;
             }
@@ -114,21 +139,19 @@ class Startup {
         const method = Startup.marker()?.method;
         switch (platform) {
             case "windows":
-                try {
-                    (0, child_process_1.execFileSync)("schtasks", ["/Delete", "/TN", SERVICE_NAME, "/F"], { stdio: "ignore" });
-                }
-                catch { }
+                removeLegacyTask();
+                fs_1.default.rmSync(windowsLauncher(), { force: true });
                 break;
             case "linux":
                 if (method === "root-crontab")
                     await execSudo(`sh -c ${quote(cronEdit())}`);
                 else
-                    (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit" });
+                    (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit", windowsHide: true });
                 break;
             case "mac":
                 if (fs_1.default.existsSync(plistPath())) {
                     try {
-                        (0, child_process_1.execFileSync)("launchctl", ["unload", "-w", plistPath()], { stdio: "ignore" });
+                        (0, child_process_1.execFileSync)("launchctl", ["unload", "-w", plistPath()], { stdio: "ignore", windowsHide: true });
                     }
                     catch { }
                     fs_1.default.rmSync(plistPath(), { force: true });
@@ -163,12 +186,11 @@ class Startup {
                 case "linux":
                     if (marker?.method === "root-crontab")
                         return true;
-                    return (0, child_process_1.execFileSync)("sh", ["-c", "crontab -l 2>/dev/null || true"], { encoding: "utf8" }).includes(CRON_MARK);
+                    return (0, child_process_1.execFileSync)("sh", ["-c", "crontab -l 2>/dev/null || true"], { encoding: "utf8", windowsHide: true }).includes(CRON_MARK);
                 case "mac":
                     return fs_1.default.existsSync(plistPath());
                 case "windows":
-                    (0, child_process_1.execFileSync)("schtasks", ["/Query", "/TN", SERVICE_NAME], { stdio: "ignore" });
-                    return true;
+                    return fs_1.default.existsSync(windowsLauncher());
                 default:
                     return false;
             }

package/dist/utils/trust.js

@@ -32,7 +32,7 @@ function execSudo(cmd) {
 }
 function hasBinary(bin) {
     try {
-        (0, child_process_1.execSync)(`command -v ${bin}`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`command -v ${bin}`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {
@@ -75,6 +75,7 @@ function trustNssDbs(certPath) {
         try {
             (0, child_process_1.execSync)(`certutil -d "${db}" -A -t "C,," -n "${CA_NAME}" -i "${certPath}"`, {
                 stdio: "ignore",
+                windowsHide: true,
             });
         }
         catch {
@@ -87,7 +88,7 @@ function untrustNssDbs() {
         return;
     for (const db of nssProfileDirs()) {
         try {
-            (0, child_process_1.execSync)(`certutil -d "${db}" -D -n "${CA_NAME}"`, { stdio: "ignore" });
+            (0, child_process_1.execSync)(`certutil -d "${db}" -D -n "${CA_NAME}"`, { stdio: "ignore", windowsHide: true });
         }
         catch {
             // Not present in this profile — nothing to remove.
@@ -133,7 +134,7 @@ async function untrustMac() {
 }
 function isTrustedMac(certPath) {
     try {
-        (0, child_process_1.execSync)(`security verify-cert -c "${certPath}"`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`security verify-cert -c "${certPath}"`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {
@@ -148,7 +149,7 @@ async function untrustWindows() {
 }
 function isTrustedWindows() {
     try {
-        (0, child_process_1.execSync)(`certutil -store Root "${CA_NAME}"`, { stdio: "ignore" });
+        (0, child_process_1.execSync)(`certutil -store Root "${CA_NAME}"`, { stdio: "ignore", windowsHide: true });
         return true;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "1.6.0-beta.1",
+  "version": "1.6.0-beta.3",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",