locadot 1.6.0-beta.7 → 2.1.0-beta.0

package/CHANGELOG.md

@@ -1,12 +1,18 @@
 # Changelog
 
-## Unreleased
+## 2.1.0-beta.0 (2026-09-27)
 
-The version in `package.json` is 1.6.0-beta.7 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
-breaking items below.
+### Added
+- Remote access: share your whole locadot with another locadot over a Cloudflare named tunnel, a quick tunnel, or any URL.
+  Receivers pair with a one-time string (5 minutes) and get viewer, editor or admin access, which the sender can change or
+  revoke. The sender's mappings appear in the receiver's locadot; clashing names become `<host>.<remote>.localhost`.
+  New commands: `hub*`, `share`, `peers*`, `connect`, `remotes`, `remote:*` and `disconnect`. There are also new dashboard cards.
+- Dashboard: a collapsible sidebar with section links, active-section highlighting and counts. Collapse it to an icon rail
+  (remembered per browser); on small screens it is a slide-out drawer.
+
+## 2.0.0 (2026-09-26)
 
 ### Changed
-- Dashboard: two-column layout, host filter, and a System / Light / Dark theme toggle (saved per browser).
 - Internal restructure into `cli/commands/*`, `server/*` and `proxy/*` modules. There are no behaviour changes; see `tasks/README.md`.
 
 ### Breaking
@@ -18,7 +24,7 @@ breaking items below.
 
 ### Added
 - `locadot tunnel --host <h>` (with `--off`, and `tunnel:install`) shares a mapping on a public `https://*.trycloudflare.com` URL through a Cloudflare quick tunnel, with no account needed. `cloudflared` is downloaded on demand into the state dir. The dashboard has a Cloudflare Tunnel card, a Public URL column and Share/Unshare per row. The API accepts `PUT /api/hosts/:host {"tunnel": true}` and has `POST /api/cloudflared/install`. `--cors` also works for tunnel visitors (the shim, preflights and origin rewriting to the public URL), but their pass-through calls may only reach public addresses; loopback, LAN and metadata addresses are refused at connect time.
-- The dashboard is redesigned: a neutral palette that follows the system light/dark theme, a responsive grid and a single Traffic column.
+- The dashboard is redesigned: a two-column layout, a host filter, loading/offline/empty states, cards on small screens, and a system / light / dark theme toggle.
 - `locadot start --port <http> --https-port <https>` (also on `restart`) runs the proxy on other ports than 80/443. The choice is saved in the state dir, so `add`, `status`, `open` and start-at-boot keep using it; `--port 80 --https-port 443` goes back. Running it while the proxy is up on other ports restarts it on the new ones.
 - `--cors` per mapping (CLI, API and dashboard). `Origin`/`Referer` are sent as the target's own origin, CORS preflights are answered locally, and any origin may call the domain with credentials. Absolute URLs of other mapped domains in text responses are rewritten to their `.localhost` names, and a mapped caller is sent as its real origin, so a site plus its API both work locally. Pages also get a small script that sends calls to any other origin through the page's own origin (`/__locadot/x/…`), so no mapping per API or third-party domain is needed. (ENH-12, BUG-15)
 - A control panel at `https://localhost` with a dark theme. You can add, edit and remove mappings, toggle CA trust and start-at-boot, see root/admin and privileged-port status,

package/README.md

@@ -1,7 +1,16 @@
 # locadot 🔐
 
+[![npm](https://img.shields.io/npm/v/locadot.svg)](https://www.npmjs.com/package/locadot)
+[![license](https://img.shields.io/npm/l/locadot.svg)](LICENSE)
+
 HTTPS custom domains for local development. Point `https://app.localhost` at your dev server on port 3000, or
-`https://google.localhost` at any upstream URL, and see every mapping on a dashboard at `https://localhost`.
+`https://google.localhost` at any upstream URL, share any of them on a public URL, and manage it all from a dashboard at
+`https://localhost`.
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/avinashid/locadot/main/docs/screenshots/dashboard-dark.png">
+  <img alt="The locadot dashboard: hosts with health, traffic and public URLs, plus add-host, system and sharing panels" src="https://raw.githubusercontent.com/avinashid/locadot/main/docs/screenshots/dashboard-light.png">
+</picture>
 
 ## ✨ Features
 
@@ -9,8 +18,13 @@ HTTPS custom domains for local development. Point `https://app.localhost` at you
   Run `locadot trust` once to add the CA to your system and browsers.
 - 🔁 **Any destination.** A local port (`--port 3000`), a host and port (`--target 192.168.1.5:8080`), or any URL
   (`--target https://google.com`). Redirects and cookies are rewritten so the browser stays on the `.localhost` name.
-- 📋 **Control panel at `https://localhost`.** Add, edit and remove mappings, see health and traffic, and toggle CA trust and
-  start-at-boot. Includes a token-protected JSON API, so scripts and AI agents can do everything the page does.
+- 🌍 **Share on a public URL.** `locadot tunnel --host app.localhost` (or **Share** in the dashboard) puts a mapping on
+  `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed.
+- 🧩 **`--cors` for sites that call other domains.** Preflights are answered locally and cross-origin calls are routed
+  through the page's own origin, so a production frontend works against its real APIs from `.localhost`.
+- 📋 **Control panel at `https://localhost`.** Add, edit, filter and remove mappings, see health and traffic, share them,
+  and toggle CA trust and start-at-boot. Light, dark or system theme. Includes a token-protected JSON API, so scripts and
+  AI agents can do everything the page does.
 - 🔌 **WebSockets** are proxied too, so HMR and dev-server live reload work.
 - 🩺 **`status` and `doctor`** show why a domain isn't working: port conflicts, permissions, CA trust, a target that isn't answering.
 - 🛡️ **Local by default.** The proxy binds to `127.0.0.1` / `::1` only. Domains must end in `.localhost`, which browsers
@@ -22,6 +36,7 @@ HTTPS custom domains for local development. Point `https://app.localhost` at you
 ## 🚀 Quick start
 
 ```bash
+npm i -g locadot                                    # or prefix each command with npx
 npx locadot trust                                   # once: trust the locadot CA (asks for your password)
 npx locadot add --host app.localhost --port 3000    # https://app.localhost → http://localhost:3000
 npx locadot add --host google.localhost --target https://google.com
@@ -86,6 +101,30 @@ pass-through calls may only go to public addresses: loopback, LAN, link-local an
 on the address actually dialled, so the tunnel can't be used to reach your machine or network. The dashboard can also do this:
 use **Share** / **Unshare** on a row.
 
+### Remote access (locadot to locadot)
+
+One machine (the sender) publishes its whole locadot on a Cloudflare hostname. Other machines (receivers) connect with a
+short-lived pairing string, and the sender's mappings then show up in the receiver's own locadot and dashboard.
+
+| Command | What it does |
+| --- | --- |
+| `locadot hub:setup --domain dev.example.com` | Sender: publish through your own named tunnel on your Cloudflare domain (runs `cloudflared` login, creates the tunnel and routes DNS). The address stays the same. |
+| `locadot hub:quick` | Sender: publish on a trycloudflare URL. No account is needed, but **the URL changes if the tunnel restarts**, so receivers have to run `remote:url`. |
+| `locadot hub` / `hub:off` | Show the hub status and URL, or stop it. |
+| `locadot share --role viewer\|editor\|admin [--hosts a.localhost,b.localhost]` | Sender: print a pairing string. It works once and expires after 5 minutes. `--hosts` limits a viewer to those mappings. |
+| `locadot peers` / `peers:role <id> <role>` / `peers:revoke <id>` | Sender: list the connected machines, change a role, or cut one off. |
+| `locadot connect "<pairing string>" [--name alice]` | Receiver: connect and import the sender's mappings. If a name clashes, `app.localhost` becomes `app.alice.localhost`. |
+| `locadot remotes` / `remote:sync <name>` / `disconnect <name>` | Receiver: list the connections, pull new mappings, or remove the connection and its names. |
+| `locadot remote:alias <name> <remote host> <local host>` | Receiver: give a sender mapping another local name, e.g. `he.localhost`. |
+| `locadot remote:add\|remote:update\|remote:rm <name> …` | Receiver: change mappings on the sender (editor or admin). |
+| `locadot remote:url <name> <url>` | Receiver: point a connection at the sender's new URL. |
+
+Roles: **viewer** can only browse (optionally limited to the mappings picked on the invite). **editor** can also add and change
+mappings on the sender. **admin** can also delete them and change sharing. Traffic goes receiver → Cloudflare → sender →
+target, so an editor can reach anything the sender's machine can reach. Only give that role to people you trust. Only hashes
+of the tokens are stored, and failed attempts are rate limited. The sender's dashboard is never reachable through the hub.
+The dashboard has **Remote access** and **Connected machines** cards for all of this.
+
 ### Certificates
 
 | Command | What it does |
@@ -108,15 +147,27 @@ use **Share** / **Unshare** on a row.
 ## 📋 Dashboard & control panel
 
 Open `https://localhost` or `http://localhost` (or run `locadot open`). Requests for bare `localhost` / `127.0.0.1` / `::1`
-are answered by locadot itself, not proxied. The page is a control panel that follows the system light/dark theme:
+are answered by locadot itself, not proxied. On wide screens the page is a two-column layout: your hosts on the left,
+controls on the right. The button at the top right switches between the system, light and dark themes (saved per browser).
+
+<img alt="Hosts table with status, latency, traffic, a shared public URL and per-row actions" src="https://raw.githubusercontent.com/avinashid/locadot/main/docs/screenshots/hosts.png">
 
-- **System:** whether the proxy runs as root/admin, whether ports below 1024 can be bound (with the Linux sysctl fix when they
-  can't), CA trust with an on/off toggle, start-at-boot with an on/off toggle, ports, bind addresses and state dir. It also has a **Stop proxy** button.
-- **Proxies:** add a mapping (host + port / host:port / URL, and optional "Insecure TLS" and "Bypass CORS" boxes), edit a target inline, or remove one. The table shows
-  each source → destination with up/down, status, latency, its public tunnel URL and traffic (hits, errors, average ms). It refreshes every 5 s.
-- **Cloudflare Tunnel:** whether `cloudflared` is installed (with an **Install** button), and a **Share** button per row that puts the mapping on a public URL.
-- **Logs:** a live tail with refresh and clear.
-- **CLI / API snippets** you can copy.
+- **Hosts:** every mapping with its target, options (`cors`, insecure TLS), up/down status, latency, traffic (hits, errors,
+  average ms) and public tunnel URL. Filter the list, edit a target inline (Enter saves, Esc cancels), **Share** / **Unshare**
+  or remove it. A host whose target doesn't answer is marked in red. It refreshes every 5 s.
+- **Add host:** host + port / host:port / URL, with optional "Insecure TLS" and "Bypass CORS" boxes.
+- **System:** ports, bind addresses and state dir, whether the proxy runs as root/admin, whether ports below 1024 can be bound
+  (with the Linux sysctl fix when they can't), CA trust and start-at-boot toggles, and a **Stop proxy** button.
+- **Sharing:** whether `cloudflared` is installed, with an **Install** button when it isn't.
+- **Logs:** a live tail with refresh and clear. **CLI & API:** snippets you can copy.
+
+If the proxy stops, the page says so, disables the controls and reconnects by itself when it's back. On phones and tablets
+hosts become cards:
+
+<p>
+  <img alt="Dashboard on a phone, light theme" src="https://raw.githubusercontent.com/avinashid/locadot/main/docs/screenshots/mobile.png" width="260">
+  <img alt="Dashboard on a phone, dark theme" src="https://raw.githubusercontent.com/avinashid/locadot/main/docs/screenshots/mobile-dark.png" width="260">
+</p>
 
 Trust and start-at-boot may need elevation. locadot asks the OS for it (polkit on Linux, the password dialog on macOS, UAC on Windows).
 If that isn't possible, for example on a headless Linux box, the panel shows the exact command to run instead: `sudo locadot trust`,
@@ -160,6 +211,19 @@ The dashboard is served only for the bare `localhost` host names, which also blo
 
 ---
 
+## ⬆️ Upgrading from 1.x
+
+2.0 changes a few defaults. Your mappings are migrated automatically.
+
+- The proxy listens on `127.0.0.1` and `::1` only. Set `LOCADOT_BIND=0.0.0.0` if you relied on LAN access.
+- The registry is stored in a new format that 1.x can't read. Don't downgrade without backing up `locadot path:hosts`.
+- `-h` means `--host` on every command. Help is `--help`.
+- Bare `localhost` is the dashboard and can't be mapped.
+
+See [CHANGELOG.md](CHANGELOG.md) for everything new.
+
+---
+
 ## ⚙️ Configuration
 
 All optional, via environment variables. Set them for the CLI; the proxy it starts inherits them.

package/dist/cli/commands/index.js

@@ -38,6 +38,7 @@ const proxy = __importStar(require("./proxy"));
 const files = __importStar(require("./files"));
 const system = __importStar(require("./system"));
 const tunnel = __importStar(require("./tunnel"));
+const remote = __importStar(require("./remote"));
 const doctor_1 = require("./doctor");
-const Commands = { ...hosts, ...proxy, ...files, ...system, ...tunnel, doctor: doctor_1.doctor };
+const Commands = { ...hosts, ...proxy, ...files, ...system, ...tunnel, ...remote, doctor: doctor_1.doctor };
 exports.default = Commands;

package/dist/cli/commands/remote.js

@@ -0,0 +1,276 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hub = hub;
+exports.hubSetup = hubSetup;
+exports.hubQuick = hubQuick;
+exports.hubManual = hubManual;
+exports.hubOff = hubOff;
+exports.share = share;
+exports.peers = peers;
+exports.peersRole = peersRole;
+exports.peersRevoke = peersRevoke;
+exports.connect = connect;
+exports.remotes = remotes;
+exports.remoteSync = remoteSync;
+exports.remoteAlias = remoteAlias;
+exports.remoteUrl = remoteUrl;
+exports.remoteAdd = remoteAdd;
+exports.remoteUpdate = remoteUpdate;
+exports.remoteRm = remoteRm;
+exports.disconnect = disconnect;
+const http_1 = __importDefault(require("http"));
+const constants_1 = __importDefault(require("../../constants"));
+const proxy_control_1 = __importDefault(require("../../lib/proxy-control"));
+const localhost_1 = require("../../lib/localhost");
+const urls_1 = require("../../lib/urls");
+const registry_1 = __importDefault(require("../../lib/registry"));
+const file_1 = __importDefault(require("../../utils/file"));
+const links_1 = __importDefault(require("../../lib/links"));
+const hub_config_1 = __importDefault(require("../../lib/hub-config"));
+const hub_tunnel_1 = require("../../proxy/hub-tunnel");
+const remotes_1 = __importDefault(require("../../lib/remotes"));
+const shared_1 = require("../shared");
+const ROLES = ["viewer", "editor", "admin"];
+const requireRole = (value) => {
+    if (typeof value !== "string" || !ROLES.includes(value)) {
+        throw new localhost_1.InputError(`❌ Invalid role "${value}". Use viewer, editor or admin.`);
+    }
+    return value;
+};
+const splitHosts = (value) => value
+    ? value
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+    : undefined;
+const requireRunning = () => {
+    if (!proxy_control_1.default.running())
+        throw new localhost_1.InputError("❌ The proxy isn't running. Run `locadot start`.");
+};
+const apiToken = () => {
+    const token = proxy_control_1.default.running() ? file_1.default.read("API_TOKEN")?.trim() : undefined;
+    if (!token)
+        throw new localhost_1.InputError("❌ No API token found. Run `locadot start`.");
+    return token;
+};
+/** Talks to the running proxy's local dashboard API on its HTTP port. */
+const dashboardRequest = (method, path, options = {}) => new Promise((resolve, reject) => {
+    const data = options.body !== undefined ? JSON.stringify(options.body) : undefined;
+    const req = http_1.default.request({
+        host: "127.0.0.1",
+        port: constants_1.default.server.httpPort,
+        path,
+        method,
+        headers: {
+            Host: "localhost",
+            ...(data ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(data) } : {}),
+            ...options.headers,
+        },
+        timeout: 5000,
+    }, (res) => {
+        let body = "";
+        res.on("data", (chunk) => (body += chunk));
+        res.on("end", () => {
+            try {
+                resolve({ status: res.statusCode || 0, json: body ? JSON.parse(body) : undefined });
+            }
+            catch {
+                reject(new localhost_1.InputError("❌ The proxy didn't answer. Is it running? Try `locadot status`."));
+            }
+        });
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", () => reject(new localhost_1.InputError("❌ The proxy isn't running. Run `locadot start`.")));
+    if (data)
+        req.write(data);
+    req.end();
+});
+const getHub = async () => {
+    requireRunning();
+    const { status, json } = await dashboardRequest("GET", "/api/hub");
+    if (status !== 200)
+        throw new localhost_1.InputError("❌ Couldn't read hub status. Try `locadot status`.");
+    return json;
+};
+const HUB_EMOJI = { off: "🔒", starting: "⏳", up: "🌍", error: "❌", login: "🔑" };
+async function hub(options) {
+    const { hub } = await getHub();
+    if (options.json) {
+        console.log(JSON.stringify(hub, null, 2));
+        return;
+    }
+    if (!hub.enabled) {
+        (0, shared_1.print)("🔒 Remote access is off. Turn it on: locadot hub:setup / hub:quick / hub:manual");
+        return;
+    }
+    (0, shared_1.print)(`${HUB_EMOJI[hub.status] ?? "❔"} ${hub.mode} — ${hub.status}${hub.url ? `: ${hub.url}` : ""}`);
+    if (hub.loginUrl)
+        (0, shared_1.print)(`   Open to finish login: ${hub.loginUrl}`);
+    if (hub.error)
+        (0, shared_1.print)(`   ${hub.error}`);
+}
+async function hubSetup(options) {
+    if (!options.domain)
+        throw new localhost_1.InputError("❌ Missing --domain <domain>.");
+    (0, shared_1.print)(`🔗 Setting up a named tunnel for ${options.domain}…`);
+    const config = await (0, hub_tunnel_1.setupNamedTunnel)(options.domain, options.tunnel, (loginUrl) => {
+        (0, shared_1.print)(`🔑 Open this URL to log in to Cloudflare: ${loginUrl}`);
+        (0, shared_1.print)("   Waiting for login…");
+    });
+    hub_config_1.default.write(config);
+    (0, shared_1.print)(`✅ Hub configured: https://${options.domain}`);
+    (0, shared_1.print)("   The running proxy watches this and starts the tunnel automatically. Not running? `locadot start`.");
+}
+async function hubQuick() {
+    hub_config_1.default.write({ mode: "quick" });
+    (0, shared_1.print)("🌍 Quick tunnel enabled (trycloudflare.com).");
+    (0, shared_1.print)("⚠️  The trycloudflare URL changes whenever cloudflared or the proxy restarts.");
+    (0, shared_1.print)("   When that happens, tell receivers to run: locadot remote:url <name> <new-url>");
+    (0, shared_1.print)("   Check the current URL any time: locadot hub");
+    (0, shared_1.print)("   The running proxy watches this and starts the tunnel automatically. Not running? `locadot start`.");
+}
+async function hubManual(options) {
+    if (!options.url)
+        throw new localhost_1.InputError("❌ Missing --url <url>.");
+    let parsed;
+    try {
+        parsed = new URL(options.url);
+    }
+    catch {
+        throw new localhost_1.InputError(`❌ Invalid URL "${options.url}".`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new localhost_1.InputError(`❌ Invalid URL "${options.url}". Use http:// or https://.`);
+    }
+    hub_config_1.default.write({ mode: "manual", url: options.url.replace(/\/+$/, "") });
+    (0, shared_1.print)(`✅ Hub configured: ${parsed.origin}`);
+    (0, shared_1.print)("   The running proxy watches this automatically. Not running? `locadot start`.");
+}
+async function hubOff() {
+    hub_config_1.default.clear();
+    (0, shared_1.print)("🔒 Remote access turned off.");
+}
+async function share(options) {
+    const role = requireRole(options.role);
+    if (options.hosts && role !== "viewer") {
+        (0, shared_1.print)(`⚠️  --hosts is ignored for ${role}s: they see every host.`);
+    }
+    const hosts = role === "viewer" ? splitHosts(options.hosts) : undefined;
+    requireRunning();
+    const { status, json } = await dashboardRequest("POST", "/api/invites", {
+        headers: { "X-Locadot-Token": apiToken() },
+        body: { role, hosts },
+    });
+    if (status === 409) {
+        throw new localhost_1.InputError("❌ The hub isn't up. Set it up first: locadot hub:setup / hub:quick / hub:manual.");
+    }
+    if (status !== 200 && status !== 201) {
+        throw new localhost_1.InputError(`❌ Couldn't create an invite (${status})${json?.error ? `: ${json.error}` : ""}.`);
+    }
+    (0, shared_1.print)("🔗 Pairing code (valid for 5 minutes, one use):");
+    (0, shared_1.print)("");
+    (0, shared_1.print)(`   ${json.string}`);
+    (0, shared_1.print)("");
+    (0, shared_1.print)(`   Role: ${json.role}${json.hosts ? ` — hosts: ${json.hosts.join(", ")}` : ""}`);
+}
+async function peers(options) {
+    const { invites, peers } = links_1.default.list();
+    if (options.json) {
+        console.log(JSON.stringify({ invites, peers }, null, 2));
+        return;
+    }
+    if (!peers.length)
+        (0, shared_1.print)("No peers yet. Create an invite: locadot share --role viewer");
+    for (const peer of peers) {
+        (0, shared_1.print)(`${peer.id}  ${peer.name}  ${peer.role}${peer.hosts ? `  [${peer.hosts.join(", ")}]` : ""}  last seen: ${peer.lastSeen ?? "never"}`);
+    }
+    if (invites.length)
+        (0, shared_1.print)(`⏳ Pending invites: ${invites.length}`);
+}
+async function peersRole(id, role, options) {
+    const parsedRole = requireRole(role);
+    const hosts = parsedRole === "viewer" ? splitHosts(options.hosts) : undefined;
+    const peer = links_1.default.setRole(id, parsedRole, hosts);
+    (0, shared_1.print)(`✅ ${peer.name} is now ${peer.role}${peer.hosts ? ` [${peer.hosts.join(", ")}]` : ""}.`);
+}
+async function peersRevoke(id) {
+    links_1.default.revoke(id);
+    (0, shared_1.print)(`🗑️  Revoked peer ${id}.`);
+}
+async function connect(value, options) {
+    const { remote, mapped, skipped } = await remotes_1.default.connect(value, { name: options.name });
+    (0, shared_1.print)(`✅ Connected to ${remote.name} (${remote.sender.hostname}) as ${remote.role}.`);
+    for (const m of mapped)
+        (0, shared_1.print)(`   ${(0, urls_1.urlFor)(m.local)}  →  ${m.host}`);
+    for (const reason of skipped)
+        (0, shared_1.print)(`   ⚠️  skipped: ${reason}`);
+}
+async function remotes(options) {
+    const list = remotes_1.default.list();
+    const registry = registry_1.default.read();
+    const aliasesFor = (name) => Object.entries(registry.hosts)
+        .filter(([, entry]) => entry.remote?.name === name)
+        .map(([local, entry]) => ({ local, host: entry.remote.host }));
+    if (options.json) {
+        console.log(JSON.stringify(list.map(({ token, ...remote }) => ({ ...remote, aliases: aliasesFor(remote.name) })), null, 2));
+        return;
+    }
+    if (!list.length) {
+        (0, shared_1.print)("No remotes. Connect to one: locadot connect <pairing-string>");
+        return;
+    }
+    for (const remote of list) {
+        (0, shared_1.print)(`${remote.name}  ${remote.url}  (${remote.role})`);
+        for (const alias of aliasesFor(remote.name))
+            (0, shared_1.print)(`   ${(0, urls_1.urlFor)(alias.local)}  →  ${alias.host}`);
+    }
+}
+async function remoteSync(name) {
+    const { mapped } = await remotes_1.default.sync(name);
+    (0, shared_1.print)(`✅ ${name} synced.`);
+    for (const m of mapped)
+        (0, shared_1.print)(`   + ${(0, urls_1.urlFor)(m.local)}  →  ${m.host}`);
+}
+async function remoteAlias(name, remoteHost, localHost) {
+    await remotes_1.default.alias(name, remoteHost, localHost);
+    (0, shared_1.print)(`✅ ${(0, urls_1.urlFor)(localHost)}  →  ${remoteHost} (${name})`);
+}
+async function remoteUrl(name, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new localhost_1.InputError(`❌ Invalid URL "${url}".`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new localhost_1.InputError(`❌ Invalid URL "${url}". Use http:// or https://.`);
+    }
+    remotes_1.default.setUrl(name, url.replace(/\/+$/, ""));
+    (0, shared_1.print)(`✅ ${name} now points to ${parsed.origin}.`);
+}
+async function remoteAdd(name, options) {
+    if (!options.host)
+        throw new localhost_1.InputError("❌ Missing --host <host>.");
+    if (!options.target)
+        throw new localhost_1.InputError("❌ Missing --target <url>.");
+    await remotes_1.default.addHost(name, { host: options.host, target: options.target, insecure: options.insecure, cors: options.cors });
+    (0, shared_1.print)(`✅ ${options.host}  →  ${options.target} on ${name}.`);
+}
+async function remoteUpdate(name, options) {
+    if (!options.host)
+        throw new localhost_1.InputError("❌ Missing --host <host>.");
+    await remotes_1.default.updateHost(name, options.host, { target: options.target, cors: options.cors });
+    (0, shared_1.print)(`✅ Updated ${options.host} on ${name}.`);
+}
+async function remoteRm(name, host) {
+    await remotes_1.default.removeHost(name, host);
+    (0, shared_1.print)(`🗑️  Removed ${host} from ${name}.`);
+}
+async function disconnect(name) {
+    await remotes_1.default.disconnect(name);
+    (0, shared_1.print)(`🔌 Disconnected from ${name}.`);
+}

package/dist/constants/index.js

@@ -38,6 +38,10 @@ Constants.paths = {
     // Secret for the dashboard's mutating API; rotated on every proxy start.
     API_TOKEN: path_1.default.join(PACKAGE_PATH, ".locadot-token"),
     CONFIG_FILE,
+    // Remote access. Sender: public hostname config, invites + peers (0600). Receiver: remotes (0600).
+    HUB_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-hub.json"),
+    LINKS_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-links.json"),
+    REMOTES_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-remotes.json"),
 };
 Constants.validPort = validPort;
 Constants.server = {