locadot 1.6.0-beta.3 → 1.6.0-beta.4

package/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-The version in `package.json` is 1.6.0-beta.3 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
+The version in `package.json` is 1.6.0-beta.4 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
 breaking items below.
 
 ### Breaking
@@ -13,7 +13,8 @@ breaking items below.
 - Bare `localhost` is reserved for the dashboard and can't be mapped.
 
 ### Added
-- `--cors` per mapping (CLI, API and dashboard). `Origin`/`Referer` are sent as the target's own origin, CORS preflights are answered locally, and any origin may call the domain with credentials. (ENH-12)
+- `locadot start --port <http> --https-port <https>` (also on `restart`) runs the proxy on other ports than 80/443. The choice is saved in the state dir, so `add`, `status`, `open` and start-at-boot keep using it; `--port 80 --https-port 443` goes back. Running it while the proxy is up on other ports restarts it on the new ones.
+- `--cors` per mapping (CLI, API and dashboard). `Origin`/`Referer` are sent as the target's own origin, CORS preflights are answered locally, and any origin may call the domain with credentials. Absolute URLs of other mapped domains in text responses are rewritten to their `.localhost` names, and a mapped caller is sent as its real origin, so a site plus its API both work locally. Pages also get a small script that sends calls to any other origin through the page's own origin (`/__locadot/x/…`), so no mapping per API or third-party domain is needed. (ENH-12, BUG-15)
 - A control panel at `https://localhost` with a dark theme. You can add, edit and remove mappings, toggle CA trust and start-at-boot, see root/admin and privileged-port status,
   tail and clear logs, and stop the proxy. (FEAT-05)
 - A token-protected JSON API for scripts and AI agents (`POST/PUT/DELETE /api/hosts`, `/api/startup`, `/api/trust`, `/api/logs`, `/api/proxy/stop`),

package/README.md

@@ -29,7 +29,8 @@ npx locadot open                                    # opens the dashboard at htt
 ```
 
 > **Linux:** ports 80/443 need root. Either run locadot with `sudo`, or allow unprivileged binding once:
-> `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80` (persist it in `/etc/sysctl.d/`). `locadot doctor` checks this for you.
+> `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80` (persist it in `/etc/sysctl.d/`). Or use other ports:
+> `locadot start --port 8080 --https-port 8443` (URLs then include the port). `locadot doctor` checks this for you.
 
 ---
 
@@ -54,16 +55,16 @@ Options for `add` / `update`:
 | `-p, --port <port>` | Shorthand for `--target http://localhost:<port>`. |
 | `-t, --target <url>` | Any http(s) upstream. A bare `host:port` means `http://host:port`. |
 | `-k, --insecure` | Don't verify the TLS certificate of an `https` target (self-signed upstreams). |
-| `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. URLs hard-coded in pages still go to the real domain. |
+| `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. The page's calls to other domains go through locadot automatically, with no extra mapping (see [Sites that call other domains](#sites-that-call-other-domains---cors)). |
 | `--no-start` | Save the mapping without starting the proxy. |
 
 ### Proxy
 
 | Command | What it does |
 | --- | --- |
-| `locadot start` | Start the central proxy. Fails loudly with the reason if it can't bind its ports. |
+| `locadot start [--port 8080] [--https-port 8443]` | Start the central proxy. Default ports are 80 and 443. Ports you pass are remembered for later commands and start-at-boot, and a running proxy is moved to them. Fails loudly with the reason if it can't bind its ports. |
 | `locadot stop` | Stop the proxy. Mappings and logs are kept. |
-| `locadot restart` | Stop, then start. |
+| `locadot restart [--port …] [--https-port …]` | Stop, then start. |
 | `locadot kill` | Stop the proxy, remove all mappings and clear the logs. |
 | `locadot status [--json]` | Is it running, its PID, ports, number of hosts, CA trust, start-at-boot, dashboard URL. |
 | `locadot doctor [--host h]` | Check the proxy, ports, permissions, CA trust, the registry and every target. Exits 1 if anything fails. |
@@ -148,8 +149,8 @@ All optional, via environment variables. Set them for the CLI; the proxy it star
 | Variable | Default | Purpose |
 | --- | --- | --- |
 | `LOCADOT_HOME` | OS app-data dir (`~/.config/locadot` on Linux) | Where the registry, logs, lock file and certs live. |
-| `LOCADOT_HTTP_PORT` | `80` | HTTP port of the proxy. |
-| `LOCADOT_HTTPS_PORT` | `443` | HTTPS port of the proxy. |
+| `LOCADOT_HTTP_PORT` | `80` | HTTP port of the proxy. Overrides the port saved by `locadot start --port`. |
+| `LOCADOT_HTTPS_PORT` | `443` | HTTPS port of the proxy. Overrides the port saved by `locadot start --https-port`. |
 | `LOCADOT_BIND` | `127.0.0.1,::1` | Comma-separated addresses to listen on. Use `0.0.0.0` to expose your mappings to your LAN (not recommended). |
 | `LOCADOT_LOG_LEVEL` | `info` | winston log level (`debug` logs every WebSocket upgrade). |
 
@@ -165,6 +166,26 @@ redirect to a *different* domain (for example `google.com` → `www.google.com`)
 locadot, map the final host instead (`--target https://www.google.com`). Some sites refuse to be framed or proxied; that's up to
 the site.
 
+### Sites that call other domains (`--cors`)
+
+A frontend that calls its API or third-party services by absolute URL works with just the site mapped:
+
+```bash
+locadot add --host signalsant.localhost --target https://signalsant.com --cors
+```
+
+- **Pass-through.** HTML pages get a small script (`/__locadot/shim.js`) as the first thing in `<head>`. It sends `fetch`,
+  `XMLHttpRequest`, `EventSource`, `WebSocket` and `sendBeacon` calls to other origins through the page's own origin
+  (`/__locadot/x/https/api.signalsant.com/…`). The browser sees a same-origin request, so CORS never applies, and locadot
+  forwards it with `Origin: https://signalsant.com`. Only the page itself can use it: requests from other sites get a 403.
+- **Cookies.** The page's cookies are forwarded only to the same site (`api.signalsant.com`), never to third parties.
+  Cookies set by third parties are dropped.
+- **Mapped domains.** If you also map a domain (`api.signalsant.localhost` → `https://api.signalsant.com --cors`), its URLs in
+  HTML/JS/CSS/JSON are rewritten to the `.localhost` name and it's called there directly.
+
+Rewritten responses are buffered and sent uncompressed. Event streams and binary files pass through untouched. Not covered:
+requests made by web workers or service workers, and `<form>` posts or `<img>`/`<script>` tags (these don't need CORS).
+
 ---
 
 ## 🛠️ Contributing

package/dist/constants/index.js

@@ -4,16 +4,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const appdata_path_1 = __importDefault(require("appdata-path"));
+const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 // LOCADOT_HOME / LOCADOT_*_PORT let tests and hosts where 80/443 are taken run an isolated instance.
 const PACKAGE_PATH = process.env.LOCADOT_HOME
     ? path_1.default.resolve(process.env.LOCADOT_HOME)
     : (0, appdata_path_1.default)("locadot");
-const envPort = (name, fallback) => {
-    const value = Number(process.env[name]);
-    return Number.isInteger(value) && value > 0 && value < 65536 ? value : fallback;
+const CONFIG_FILE = path_1.default.join(PACKAGE_PATH, ".locadot-config.json");
+const validPort = (value) => {
+    const port = Number(value);
+    return Number.isInteger(port) && port > 0 && port < 65536 ? port : undefined;
 };
+// Ports chosen with `locadot start --port/--https-port`, so later commands and boot startup reuse them.
+const savedPorts = () => {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(CONFIG_FILE, "utf8")) || {};
+    }
+    catch {
+        return {};
+    }
+};
+const envPort = (name, saved, fallback) => validPort(process.env[name]) ?? validPort(saved) ?? fallback;
 class Constants {
 }
 Constants.paths = {
@@ -25,10 +37,12 @@ Constants.paths = {
     CERT_DIR: path_1.default.join(PACKAGE_PATH, "certs"),
     // Secret for the dashboard's mutating API; rotated on every proxy start.
     API_TOKEN: path_1.default.join(PACKAGE_PATH, ".locadot-token"),
+    CONFIG_FILE,
 };
+Constants.validPort = validPort;
 Constants.server = {
-    httpPort: envPort("LOCADOT_HTTP_PORT", 80),
-    httpsPort: envPort("LOCADOT_HTTPS_PORT", 443),
+    httpPort: envPort("LOCADOT_HTTP_PORT", savedPorts().httpPort, 80),
+    httpsPort: envPort("LOCADOT_HTTPS_PORT", savedPorts().httpsPort, 443),
     // Loopback only unless the user opts in; see tasks/enhancements ENH-06.
     bind: (process.env.LOCADOT_BIND || "127.0.0.1,::1")
         .split(",")

package/dist/index.js

@@ -66,9 +66,12 @@ program
     .command("open [host]")
     .description("Open a domain, or the dashboard when no host is given, in the browser")
     .action(run((host) => commands_1.default.open(host)));
-program.command("start").description("Start the central proxy").action(run(() => commands_1.default.start()));
+const portOptions = (command) => command
+    .option("-p, --port <port>", "HTTP port (default 80, or the last one you chose)")
+    .option("--https-port <port>", "HTTPS port (default 443, or the last one you chose)");
+portOptions(program.command("start").description("Start the central proxy")).action(run((options) => commands_1.default.start(options)));
 program.command("stop").description("Stop the central proxy (keeps hosts and logs)").action(run(() => commands_1.default.stop()));
-program.command("restart").description("Restart the central proxy").action(run(() => commands_1.default.restart()));
+portOptions(program.command("restart").description("Restart the central proxy")).action(run((options) => commands_1.default.restart(options)));
 program.command("kill").description("Stop the proxy, remove all hosts and clear logs").action(run(() => commands_1.default.kill()));
 program.command("trust").description("Install the locadot CA in the system trust store (sudo)").action(run(() => commands_1.default.trust()));
 program.command("untrust").description("Remove the locadot CA from the system trust store (sudo)").action(run(() => commands_1.default.untrust()));

package/dist/lib/commands.js

@@ -52,6 +52,27 @@ const startup_1 = __importDefault(require("../utils/startup"));
 const certs_1 = require("../utils/certs");
 const trust_1 = require("../utils/trust");
 const print = (message) => logger_1.default.info(message);
+/** Applies --port/--https-port and saves them, so `add`, `status`, `open` and boot startup use the same ports. */
+const usePorts = (options) => {
+    if (options.port === undefined && options.httpsPort === undefined)
+        return false;
+    const parse = (value, flag) => {
+        if (value === undefined)
+            return undefined;
+        const port = constants_1.default.validPort(value);
+        if (!port)
+            throw new localhost_1.InputError(`❌ ${flag} must be a port between 1 and 65535, got "${value}".`);
+        return port;
+    };
+    const httpPort = parse(options.port, "--port") ?? constants_1.default.server.httpPort;
+    const httpsPort = parse(options.httpsPort, "--https-port") ?? constants_1.default.server.httpsPort;
+    if (httpPort === httpsPort)
+        throw new localhost_1.InputError(`❌ HTTP and HTTPS can't share port ${httpPort}.`);
+    Object.assign(constants_1.default.server, { httpPort, httpsPort });
+    file_1.default.ensureDir();
+    fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ httpPort, httpsPort }, null, 2) + "\n");
+    return true;
+};
 const urlFor = (host, secure = true) => {
     const port = secure ? constants_1.default.server.httpsPort : constants_1.default.server.httpPort;
     const standard = secure ? 443 : 80;
@@ -174,7 +195,7 @@ class Commands {
                 check(listening, `Port ${port} answering`, "The proxy is running but not listening; check `locadot logs`.");
             }
             else if (listening) {
-                check(false, `Port ${port} is free`, `Something else holds port ${port}. Find it with \`sudo lsof -i :${port}\`, or set LOCADOT_${port === constants_1.default.server.httpPort ? "HTTP" : "HTTPS"}_PORT.`);
+                check(false, `Port ${port} is free`, `Something else holds port ${port}. Find it with \`sudo lsof -i :${port}\`, or pick another with \`locadot start ${port === constants_1.default.server.httpPort ? "--port" : "--https-port"} <port>\`.`);
             }
         }
         if (info && (await localhost_1.default.isPortListening(constants_1.default.server.httpPort))) {
@@ -213,19 +234,30 @@ class Commands {
         if (failures)
             process.exitCode = 1;
     }
-    static async start() {
-        const wasRunning = proxy_1.default.running();
-        const info = await proxy_1.default.start();
-        print(wasRunning ? `☑️ Proxy already running (pid ${info.pid}).` : `🚀 Central proxy started (pid ${info.pid}).`);
+    static async start(options = {}) {
+        const moved = usePorts(options);
+        const running = proxy_1.default.running();
+        // Already up on other ports: the new ones only take effect after a restart.
+        if (running && (running.httpPort !== constants_1.default.server.httpPort || running.httpsPort !== constants_1.default.server.httpsPort)) {
+            const info = await proxy_1.default.restart();
+            print(`🔁 Proxy restarted on http ${info.httpPort}, https ${info.httpsPort} (pid ${info.pid}).`);
+        }
+        else {
+            const info = await proxy_1.default.start();
+            print(running ? `☑️ Proxy already running (pid ${info.pid}).` : `🚀 Central proxy started (pid ${info.pid}).`);
+            if (moved || !running)
+                print(`   Ports:     http ${info.httpPort}, https ${info.httpsPort}`);
+        }
         print(`   Dashboard: ${(0, exports.urlFor)("localhost")}`);
     }
     static async stop() {
         const stopped = await proxy_1.default.stop();
         print(stopped ? constants_1.default.proxyInfo.softClose : "☑️ Proxy was not running.");
     }
-    static async restart() {
+    static async restart(options = {}) {
+        usePorts(options);
         const info = await proxy_1.default.restart();
-        print(`☑️ Proxy restarted (pid ${info.pid}).`);
+        print(`☑️ Proxy restarted on http ${info.httpPort}, https ${info.httpsPort} (pid ${info.pid}).`);
     }
     static async kill() {
         await proxy_1.default.kill();
@@ -262,6 +294,7 @@ class Commands {
             ["Certs", constants_1.default.paths.CERT_DIR],
             ["CA cert", (0, certs_1.caCertPath)()],
             ["API token", constants_1.default.paths.API_TOKEN],
+            ["Config", constants_1.default.paths.CONFIG_FILE],
         ];
         rows.forEach(([label, value]) => console.log(`${label.padEnd(10)} ${value}`));
     }

package/dist/lib/http.js

@@ -3,10 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyCors = exports.hostOf = void 0;
+exports.applyCors = exports.rewriteBody = exports.rewriteOrigins = exports.originMap = exports.hostOf = void 0;
+const zlib_1 = __importDefault(require("zlib"));
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
+const passthrough_1 = require("./passthrough");
 /** Host header without port, lowercased; handles [::1]:443. */
 const hostOf = (req) => {
     const raw = (req.headers.host || "").trim().toLowerCase();
@@ -22,7 +24,7 @@ const dashboardUrl = (req) => {
     const standard = tls ? 443 : 80;
     return `${tls ? "https" : "http"}://localhost${port === standard ? "" : `:${port}`}/`;
 };
-const proxyOptions = (req, entry) => ({
+const proxyOptions = (req, entry, lookup) => ({
     target: entry.target,
     changeOrigin: true,
     xfwd: true,
@@ -34,25 +36,132 @@ const proxyOptions = (req, entry) => ({
     hostRewrite: req.headers.host,
     protocolRewrite: isTls(req) ? "https" : "http",
     cookieDomainRewrite: { "*": "" },
-    headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? sameOriginHeaders(req, entry) : {}) },
+    headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? { ...sameOriginHeaders(req, entry, lookup), ...DECODABLE } : {}) },
 });
-// --cors: the upstream should see a request from its own site, so origin/CSRF checks pass.
-const sameOriginHeaders = (req, entry) => {
-    const origin = new URL(entry.target).origin;
+// --cors bodies are rewritten, so only ask for encodings we can decode (browsers also offer zstd).
+const DECODABLE = { "Accept-Encoding": "gzip, deflate, br" };
+const viaOptions = (req, entry, via) => ({
+    target: `${via.scheme}://${via.host}`,
+    changeOrigin: true,
+    ws: true,
+    secure: !entry.insecure,
+    cookieDomainRewrite: { "*": "" },
+    headers: { ...(0, passthrough_1.viaHeaders)(req, via, entry.target), ...DECODABLE },
+});
+/**
+ * --cors: the upstream should see a request from a site it trusts, so origin/CSRF checks pass.
+ * A page on another mapped domain (signalsant.localhost calling api.signalsant.localhost) is
+ * sent as that domain's real origin; anything else as the target's own origin.
+ */
+const sameOriginHeaders = (req, entry, lookup) => {
+    const upstreamOrigin = (value) => {
+        try {
+            const caller = lookup(new URL(value).hostname);
+            if (caller)
+                return new URL(caller.target).origin;
+        }
+        catch { }
+        return new URL(entry.target).origin;
+    };
     const headers = {};
     if (req.headers.origin)
-        headers.Origin = origin;
+        headers.Origin = upstreamOrigin(req.headers.origin);
     if (req.headers.referer) {
         try {
             const referer = new URL(req.headers.referer);
-            headers.Referer = origin + referer.pathname + referer.search;
+            headers.Referer = upstreamOrigin(referer.href) + referer.pathname + referer.search;
         }
         catch {
-            headers.Referer = origin + "/";
+            headers.Referer = new URL(entry.target).origin + "/";
         }
     }
     return headers;
 };
+const REWRITABLE = /^(text\/(?!event-stream)|application\/(javascript|x-javascript|ecmascript|json|xml|[\w.+-]+\+(json|xml))\b)/i;
+const DECODERS = {
+    gzip: zlib_1.default.gunzipSync,
+    "x-gzip": zlib_1.default.gunzipSync,
+    deflate: zlib_1.default.inflateSync,
+    br: zlib_1.default.brotliDecompressSync,
+};
+/** [real origin, local origin] for every mapping, e.g. https://api.x.com → https://api.x.localhost. */
+const originMap = (req, hosts) => {
+    const tls = isTls(req);
+    const port = tls ? constants_1.default.server.httpsPort : constants_1.default.server.httpPort;
+    const suffix = port === (tls ? 443 : 80) ? "" : `:${port}`;
+    const self = (0, exports.hostOf)(req);
+    const pairs = [];
+    for (const [host, entry] of Object.entries(hosts)) {
+        try {
+            pairs.push([new URL(entry.target).origin, `${tls ? "https" : "http"}://${host}${suffix}`, host === self]);
+        }
+        catch { }
+    }
+    // Longest first, so https://a.x.com is not half-replaced by a mapping for https://x.com;
+    // when two domains share a target, the one serving this response wins.
+    return pairs
+        .sort((a, b) => b[0].length - a[0].length || Number(b[2]) - Number(a[2]))
+        .map(([from, to]) => [from, to]);
+};
+exports.originMap = originMap;
+const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Replaces real origins with local ones, plain and JSON-escaped (https:\/\/…). */
+const rewriteOrigins = (text, pairs) => {
+    for (const [from, to] of pairs) {
+        for (const [a, b] of [[from, to], [from.replace(/\//g, "\\/"), to.replace(/\//g, "\\/")]]) {
+            text = text.replace(new RegExp(escapeRegex(a) + "(?![\\w.-])", "gi"), b);
+        }
+    }
+    return text;
+};
+exports.rewriteOrigins = rewriteOrigins;
+/**
+ * --cors: pages that call other domains by absolute URL (`https://api.x.com`) bypass the proxy,
+ * so the browser applies the real API's CORS policy. Rewriting mapped origins in text bodies
+ * keeps those calls on .localhost. Buffers the body; streams (SSE, binary) pass through.
+ */
+const rewriteBody = (req, res, proxyRes, pairs, inject = false) => {
+    const headers = proxyRes.headers;
+    const encoding = String(headers["content-encoding"] || "identity").toLowerCase();
+    if (!pairs.length || req.method === "HEAD" || !REWRITABLE.test(String(headers["content-type"] || "")))
+        return;
+    if (encoding !== "identity" && !DECODERS[encoding])
+        return;
+    if (proxyRes.statusCode === 204 || proxyRes.statusCode === 304)
+        return;
+    delete headers["content-length"];
+    delete headers["content-encoding"];
+    delete headers["transfer-encoding"];
+    const chunks = [];
+    const end = res.end.bind(res);
+    res.write = ((chunk) => {
+        if (chunk)
+            chunks.push(Buffer.from(chunk));
+        return true;
+    });
+    res.end = ((chunk) => {
+        if (chunk && typeof chunk !== "function")
+            chunks.push(Buffer.from(chunk));
+        let body = Buffer.concat(chunks);
+        try {
+            if (encoding !== "identity")
+                body = DECODERS[encoding](body);
+            let text = (0, exports.rewriteOrigins)(body.toString("utf8"), pairs);
+            if (inject && /^text\/html/i.test(String(headers["content-type"])))
+                text = (0, passthrough_1.injectShim)(text);
+            body = Buffer.from(text, "utf8");
+        }
+        catch (error) {
+            logger_1.default.warn(`${(0, exports.hostOf)(req)}: could not rewrite response body: ${error}`);
+            res.statusCode = 502;
+            body = Buffer.alloc(0);
+        }
+        if (!res.headersSent)
+            res.setHeader("Content-Length", body.length);
+        return end(body);
+    });
+};
+exports.rewriteBody = rewriteBody;
 const isPreflight = (req) => req.method === "OPTIONS" && !!req.headers.origin && !!req.headers["access-control-request-method"];
 /** Headers that let the calling page read the response, credentials included. */
 const allowOrigin = (req) => req.headers.origin
@@ -120,19 +229,37 @@ class HttpModule {
                 res.end();
                 return;
             }
+            if (entry.cors && req.url?.split("?")[0] === passthrough_1.SHIM_PATH) {
+                res.writeHead(200, { "Content-Type": "application/javascript; charset=utf-8", "Cache-Control": "no-store" });
+                res.end(passthrough_1.shimScript);
+                return;
+            }
+            const via = entry.cors ? (0, passthrough_1.parseVia)(req.url) : undefined;
+            if (via && !(0, passthrough_1.isSameOrigin)(req)) {
+                res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("locadot: the pass-through only serves the page's own requests.\n");
+                return;
+            }
             const started = Date.now();
             res.once("finish", () => {
                 record(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500);
             });
-            ctx.proxy.web(req, res, proxyOptions(req, entry), (err) => {
-                logger_1.default.warn(`${host} → ${entry.target}: ${err?.code || err?.message}`);
+            let options = proxyOptions(req, entry, ctx.lookup);
+            if (via) {
+                req.locadotVia = via;
+                options = viaOptions(req, entry, via);
+                req.url = via.path;
+            }
+            const upstream = via ? `${via.scheme}://${via.host}` : entry.target;
+            ctx.proxy.web(req, res, options, (err) => {
+                logger_1.default.warn(`${host} → ${upstream}: ${err?.code || err?.message}`);
                 if (res.headersSent) {
                     res.destroy();
                     return;
                 }
                 // With --cors the page should see a 502, not a CORS error.
                 res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? allowOrigin(req) : {}) });
-                res.end((0, template_1.upstreamDown)(host, entry.target, err?.code || err?.message || "error", dashboardUrl(req)));
+                res.end((0, template_1.upstreamDown)(host, upstream, err?.code || err?.message || "error", dashboardUrl(req)));
             });
         }
         catch (error) {
@@ -151,9 +278,19 @@ class HttpModule {
                 socket.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
                 return;
             }
+            const via = entry.cors ? (0, passthrough_1.parseVia)(req.url) : undefined;
+            if (via && !(0, passthrough_1.isSameOrigin)(req)) {
+                socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+                return;
+            }
             logger_1.default.debug(`WebSocket upgrade for ${host}`);
-            ctx.proxy.ws(req, socket, head, proxyOptions(req, entry), (err) => {
-                logger_1.default.warn(`${host} WebSocket → ${entry.target}: ${err?.code || err?.message}`);
+            let options = proxyOptions(req, entry, ctx.lookup);
+            if (via) {
+                options = viaOptions(req, entry, via);
+                req.url = via.path;
+            }
+            ctx.proxy.ws(req, socket, head, options, (err) => {
+                logger_1.default.warn(`${host} WebSocket → ${via ? `${via.scheme}://${via.host}` : entry.target}: ${err?.code || err?.message}`);
                 socket.destroy();
             });
         }

package/dist/lib/passthrough.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteViaResponse = exports.viaHeaders = exports.isSameSite = exports.shimScript = exports.injectShim = exports.shimTag = exports.isSameOrigin = exports.viaPath = exports.parseVia = exports.SHIM_PATH = exports.PREFIX = void 0;
+/**
+ * --cors pass-through: a page on a --cors domain calls other origins (api.x.com, a CDN's JSON,
+ * a third-party API) by absolute URL, and the browser enforces *their* CORS policy. The shim
+ * injected into its HTML sends those calls to /__locadot/x/<scheme>/<host>/<path> on the page's
+ * own origin instead, so the browser sees a same-origin request, and locadot forwards it upstream
+ * as the real site. No per-domain mapping needed.
+ */
+exports.PREFIX = "/__locadot/";
+exports.SHIM_PATH = `${exports.PREFIX}shim.js`;
+const VIA = `${exports.PREFIX}x/`;
+/** Parses /__locadot/x/https/api.x.com:8443/v1?q → {https, api.x.com:8443, /v1?q}. */
+const parseVia = (url) => {
+    const match = (url || "").match(/^\/__locadot\/x\/(https?|wss?)\/([a-z0-9.-]+(?::\d{1,5})?)(\/.*)?$/i);
+    if (!match)
+        return undefined;
+    return { scheme: match[1].toLowerCase(), host: match[2].toLowerCase(), path: match[3] || "/" };
+};
+exports.parseVia = parseVia;
+/** The local path the shim uses for an absolute URL; the inverse of parseVia. */
+const viaPath = (url) => `${VIA}${url.protocol.slice(0, -1)}/${url.host}${url.pathname}${url.search}`;
+exports.viaPath = viaPath;
+/**
+ * Only the page itself may use the pass-through. A link or form on another site would otherwise
+ * turn the proxy into a way to reach any host from the user's machine.
+ */
+const isSameOrigin = (req) => {
+    const site = req.headers["sec-fetch-site"];
+    if (site)
+        return site === "same-origin";
+    const origin = req.headers.origin;
+    if (!origin)
+        return true;
+    try {
+        return new URL(origin).host === req.headers.host;
+    }
+    catch {
+        return false;
+    }
+};
+exports.isSameOrigin = isSameOrigin;
+exports.shimTag = `<script src="${exports.SHIM_PATH}"></script>`;
+/** Adds the shim as the first script in <head>, so it runs before the app's own scripts. */
+const injectShim = (html) => {
+    if (html.includes(exports.shimTag))
+        return html;
+    const head = html.match(/<head\b[^>]*>/i);
+    if (head)
+        return html.replace(head[0], head[0] + exports.shimTag);
+    return exports.shimTag + html;
+};
+exports.injectShim = injectShim;
+exports.shimScript = `(() => {
+  if (window.__locadotShim) return;
+  window.__locadotShim = true;
+  const VIA = ${JSON.stringify(VIA)};
+  const route = (input) => {
+    try {
+      const url = new URL(String(input), location.href);
+      if (!/^(https?|wss?):$/.test(url.protocol)) return null;
+      const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+      if (local || url.host === location.host) return null;
+      const ws = url.protocol === "ws:" || url.protocol === "wss:";
+      const base = ws ? (location.protocol === "https:" ? "wss://" : "ws://") + location.host : location.origin;
+      return base + VIA + url.protocol.slice(0, -1) + "/" + url.host + url.pathname + url.search + url.hash;
+    } catch (e) {
+      return null;
+    }
+  };
+  const fetch0 = window.fetch;
+  if (fetch0) {
+    window.fetch = function (input, init) {
+      if (typeof Request !== "undefined" && input instanceof Request) {
+        const to = route(input.url);
+        if (to) input = new Request(to, input);
+      } else {
+        const to = route(input);
+        if (to) input = to;
+      }
+      return fetch0.call(this, input, init);
+    };
+  }
+  if (window.XMLHttpRequest) {
+    const open0 = XMLHttpRequest.prototype.open;
+    XMLHttpRequest.prototype.open = function (method, url) {
+      const args = Array.prototype.slice.call(arguments);
+      const to = route(url);
+      if (to) args[1] = to;
+      return open0.apply(this, args);
+    };
+  }
+  const wrap = (name) => {
+    const Original = window[name];
+    if (!Original) return;
+    const Wrapped = function (url, options) {
+      return new Original(route(url) || url, options);
+    };
+    Wrapped.prototype = Original.prototype;
+    Object.getOwnPropertyNames(Original).forEach((key) => {
+      if (!(key in Wrapped)) try { Wrapped[key] = Original[key]; } catch (e) {}
+    });
+    window[name] = Wrapped;
+  };
+  wrap("EventSource");
+  wrap("WebSocket");
+  if (navigator.sendBeacon) {
+    const beacon0 = navigator.sendBeacon.bind(navigator);
+    navigator.sendBeacon = (url, data) => beacon0(route(url) || url, data);
+  }
+})();
+`;
+/** The site's own domain without a leading www: signalsant.com for https://www.signalsant.com. */
+const siteDomain = (target) => new URL(target).hostname.replace(/^www\./, "");
+/** api.signalsant.com is the same site as signalsant.com; a CDN or third-party API is not. */
+const isSameSite = (host, target) => {
+    const hostname = host.replace(/:\d+$/, "");
+    const domain = siteDomain(target);
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+};
+exports.isSameSite = isSameSite;
+/** Upstream headers for a pass-through call: the request looks like it came from the real site. */
+const viaHeaders = (req, via, target) => {
+    const site = new URL(target).origin;
+    const headers = { Origin: site };
+    try {
+        if (req.headers.referer) {
+            const referer = new URL(req.headers.referer);
+            headers.Referer = site + referer.pathname + referer.search;
+        }
+    }
+    catch { }
+    // The page's cookies belong to its own site; don't hand them to third parties.
+    if (!(0, exports.isSameSite)(via.host, target))
+        delete req.headers.cookie;
+    return headers;
+};
+exports.viaHeaders = viaHeaders;
+/**
+ * Keeps a pass-through response on the pass-through: redirects are routed back through it,
+ * host-only cookies are scoped to the upstream's path, and third-party cookies are dropped.
+ */
+const rewriteViaResponse = (headers, via, target) => {
+    const base = `${VIA}${via.scheme}/${via.host}`;
+    const location = headers.location;
+    if (location) {
+        if (location.startsWith("/") && !location.startsWith("//"))
+            headers.location = base + location;
+        else {
+            try {
+                const url = new URL(location, `${via.scheme}://${via.host}/`);
+                if (/^https?:$/.test(url.protocol) && !/(^|\.)localhost$/.test(url.hostname))
+                    headers.location = (0, exports.viaPath)(url) + url.hash;
+            }
+            catch { }
+        }
+    }
+    const cookies = headers["set-cookie"];
+    if (!cookies)
+        return;
+    if (!(0, exports.isSameSite)(via.host, target)) {
+        delete headers["set-cookie"];
+        return;
+    }
+    headers["set-cookie"] = cookies.map((cookie) => {
+        // Domain=.signalsant.com is shared with the page on the real site, so keep its path.
+        if (/;\s*domain=/i.test(cookie))
+            return cookie;
+        const path = cookie.match(/;\s*path=([^;]*)/i)?.[1]?.trim() || "/";
+        return cookie.replace(/;\s*path=[^;]*/gi, "") + `; Path=${base}${path === "/" ? "" : path}`;
+    });
+};
+exports.rewriteViaResponse = rewriteViaResponse;

package/dist/proxy.js

@@ -52,7 +52,13 @@ class ProxyHandler {
         const child = (0, child_process_1.spawn)(command, args, {
             detached: true,
             stdio: ["ignore", logFd, logFd],
-            env: { ...process.env, LOCADOT_HOME: constants_1.default.paths.HOME, LOCADOT_ROLE: "proxy" },
+            env: {
+                ...process.env,
+                LOCADOT_HOME: constants_1.default.paths.HOME,
+                LOCADOT_ROLE: "proxy",
+                LOCADOT_HTTP_PORT: String(constants_1.default.server.httpPort),
+                LOCADOT_HTTPS_PORT: String(constants_1.default.server.httpsPort),
+            },
             windowsHide: true,
         });
         fs_1.default.closeSync(logFd);

package/dist/server.js

@@ -47,6 +47,7 @@ const registry_1 = __importDefault(require("./lib/registry"));
 const locadot_file_1 = __importDefault(require("./lib/locadot-file"));
 const http_2 = __importStar(require("./lib/http"));
 const localhost_1 = __importDefault(require("./lib/localhost"));
+const passthrough_1 = require("./lib/passthrough");
 const file_1 = __importDefault(require("./utils/file"));
 const logger_1 = __importDefault(require("./utils/logger"));
 const certs_1 = require("./utils/certs");
@@ -101,7 +102,7 @@ async function startCentralProxy() {
     // Hop-by-hop headers describe the upstream connection, not ours. Apache sends
     // `Connection: Upgrade, close` + `Upgrade: h2`, which made us close the browser's
     // socket after every response (ERR_TOO_MANY_RETRIES on asset-heavy pages).
-    proxy.on("proxyRes", (proxyRes, req) => {
+    proxy.on("proxyRes", (proxyRes, req, res) => {
         if (proxyRes.statusCode === 101)
             return;
         const listed = String(proxyRes.headers.connection || "")
@@ -111,8 +112,17 @@ async function startCentralProxy() {
         for (const name of [...listed, "connection", "keep-alive", "upgrade", "proxy-connection"]) {
             delete proxyRes.headers[name];
         }
-        if (registry.hosts[(0, http_2.hostOf)(req)]?.cors)
-            (0, http_2.applyCors)(req, proxyRes.headers);
+        const entry = registry.hosts[(0, http_2.hostOf)(req)];
+        if (!entry?.cors)
+            return;
+        (0, http_2.applyCors)(req, proxyRes.headers);
+        const via = req.locadotVia;
+        const pairs = (0, http_2.originMap)(req, registry.hosts);
+        if (via)
+            (0, passthrough_1.rewriteViaResponse)(proxyRes.headers, via, entry.target);
+        else if (proxyRes.headers.location)
+            proxyRes.headers.location = (0, http_2.rewriteOrigins)(proxyRes.headers.location, pairs);
+        (0, http_2.rewriteBody)(req, res, proxyRes, pairs, !via);
     });
     const info = {
         pid: process.pid,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "1.6.0-beta.3",
+  "version": "1.6.0-beta.4",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",