locadot 2.0.0 → 2.1.0-beta.1

package/dist/index.js

@@ -9,6 +9,8 @@ const commands_1 = __importDefault(require("./cli/commands"));
 const localhost_1 = require("./lib/localhost");
 const registry_1 = require("./lib/registry");
 const proxy_control_1 = require("./lib/proxy-control");
+const links_1 = require("./lib/links");
+const remotes_1 = require("./lib/remotes");
 const logger_1 = __importDefault(require("./utils/logger"));
 const package_json_1 = require("../package.json");
 const program = new commander_1.Command();
@@ -20,7 +22,11 @@ const run = (fn, { exit = true } = {}) => async (...args) => {
             process.exit(process.exitCode ?? 0);
     }
     catch (error) {
-        const known = error instanceof localhost_1.InputError || error instanceof proxy_control_1.ProxyError || error instanceof registry_1.RegistryError;
+        const known = error instanceof localhost_1.InputError ||
+            error instanceof proxy_control_1.ProxyError ||
+            error instanceof registry_1.RegistryError ||
+            error instanceof links_1.LinkError ||
+            error instanceof remotes_1.RemoteError;
         logger_1.default.error(known ? error.message : `❌ ${error?.stack || error}`);
         process.exit(1);
     }
@@ -104,4 +110,99 @@ program.command("path:hosts").description("Show the registry file path").action(
 program.command("startup:enable").description("Start locadot on boot/logon").action(run(() => commands_1.default.enableStartup()));
 program.command("startup:disable").description("Don't start locadot on boot/logon").action(run(() => commands_1.default.disableStartup()));
 program.command("startup:status").description("Is start on boot enabled?").action(run(() => commands_1.default.statusStartup()));
+const roleOption = () => new commander_1.Option("-r, --role <role>", "viewer, editor or admin").choices(["viewer", "editor", "admin"]).makeOptionMandatory();
+program
+    .command("hub")
+    .description("Show remote access status")
+    .option("--json", "Machine-readable output")
+    .action(run((options) => commands_1.default.hub(options)));
+program
+    .command("hub:setup")
+    .description("Share this locadot on your own domain via a named Cloudflare tunnel")
+    .requiredOption("-d, --domain <domain>", "Public domain, e.g. hub.example.com")
+    .option("-t, --tunnel <name>", "Cloudflare tunnel name", "locadot")
+    .action(run((options) => commands_1.default.hubSetup(options)));
+program
+    .command("hub:quick")
+    .description("Share this locadot on a random trycloudflare.com URL (no account, URL changes on restart)")
+    .action(run(() => commands_1.default.hubQuick()));
+program
+    .command("hub:manual")
+    .description("Share this locadot behind a URL something else already forwards (ngrok, a reverse proxy, tests)")
+    .requiredOption("-u, --url <url>", "Public base URL that forwards to this proxy's HTTP port")
+    .action(run((options) => commands_1.default.hubManual(options)));
+program.command("hub:off").description("Turn off remote access").action(run(() => commands_1.default.hubOff()));
+program
+    .command("hub:localhost <onOrOff>")
+    .description("Sender: let admin peers reach any port on this machine's localhost (on/off)")
+    .action(run((value) => commands_1.default.hubLocalhost(value)));
+program
+    .command("ui:password")
+    .description("Set or reset the dashboard password (prompts; hashed with scrypt). The API token keeps working for scripts")
+    .option("--off", "Remove the password; the dashboard is open to anyone on this machine again")
+    .option("--stdin", "Read the password from stdin instead of prompting")
+    .action(run((options) => commands_1.default.uiPassword(options)));
+program
+    .command("share")
+    .description("Create a one-time pairing code for someone to connect to this locadot")
+    .addOption(roleOption())
+    .option("--hosts <hosts>", "Comma separated hosts the viewer may see (viewer role only)")
+    .action(run((options) => commands_1.default.share(options)));
+program
+    .command("peers")
+    .description("List everyone paired with this locadot")
+    .option("--json", "Machine-readable output")
+    .action(run((options) => commands_1.default.peers(options)));
+program
+    .command("peers:role <id> <role>")
+    .description("Change a peer's role")
+    .option("--hosts <hosts>", "Comma separated hosts (viewer role only)")
+    .action(run((id, role, options) => commands_1.default.peersRole(id, role, options)));
+program.command("peers:revoke <id>").description("Revoke a peer").action(run((id) => commands_1.default.peersRevoke(id)));
+program
+    .command("connect <string>")
+    .description("Connect to a remote locadot using its pairing string")
+    .option("--name <name>", "Local name for this remote (defaults to the sender's hostname)")
+    .option("--domain <domain>", "Local domain for the sender's localhost, e.g. dev (admin only; random if omitted)")
+    .action(run((value, options) => commands_1.default.connect(value, options)));
+program
+    .command("remotes")
+    .description("List remotes this locadot is connected to")
+    .option("--json", "Machine-readable output")
+    .action(run((options) => commands_1.default.remotes(options)));
+program.command("remote:sync <name>").description("Refresh role and available hosts for a remote").action(run((name) => commands_1.default.remoteSync(name)));
+program
+    .command("remote:domain <name> [domain]")
+    .description("Set the local domain for a remote's localhost (admin only); no domain picks a random one")
+    .option("--off", "Remove the domain")
+    .action(run((name, domain, options) => commands_1.default.remoteDomain(name, domain, options)));
+program
+    .command("remote:alias <name> <remoteHost> <localHost>")
+    .description("Map a local .localhost name to a host on a remote")
+    .action(run((name, remoteHost, localHost) => commands_1.default.remoteAlias(name, remoteHost, localHost)));
+program
+    .command("remote:url <name> <url>")
+    .description("Update a remote's URL (e.g. after its quick tunnel changed)")
+    .action(run((name, url) => commands_1.default.remoteUrl(name, url)));
+program
+    .command("remote:add <name>")
+    .description("Add a mapping on a remote")
+    .addOption(hostOption())
+    .requiredOption("-t, --target <url>", "Any upstream: 3000, 127.0.0.1:8080, http://192.168.1.5:8080, https://google.com")
+    .option("-k, --insecure", "Don't verify the TLS certificate of an https target")
+    .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
+    .action(run((name, options) => commands_1.default.remoteAdd(name, options)));
+program
+    .command("remote:update <name>")
+    .description("Update a mapping on a remote")
+    .addOption(hostOption())
+    .option("-t, --target <url>", "New upstream")
+    .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
+    .option("--no-cors", "Turn --cors off again")
+    .action(run((name, options) => commands_1.default.remoteUpdate(name, options)));
+program
+    .command("remote:rm <name> <host>")
+    .description("Remove a mapping on a remote")
+    .action(run((name, host) => commands_1.default.remoteRm(name, host)));
+program.command("disconnect <name>").description("Disconnect from a remote").action(run((name) => commands_1.default.disconnect(name)));
 program.parseAsync(process.argv);

package/dist/lib/hub-config.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+let cache;
+/** Persists how the sender is reachable (`HUB_FILE`). No secrets in here; see links.ts for those. */
+class HubConfigStore {
+    static read() {
+        const raw = file_1.default.read("HUB_FILE");
+        if (!raw)
+            return undefined;
+        try {
+            const data = JSON.parse(raw);
+            return data && typeof data === "object" ? data : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Same as read(), but skips the parse when the file's mtime hasn't changed. Safe for the request hot path (classify()). */
+    static readCached() {
+        let mtimeMs;
+        try {
+            mtimeMs = fs_1.default.statSync(path_1.default.resolve(constants_1.default.paths.HUB_FILE)).mtimeMs;
+        }
+        catch {
+            cache = undefined;
+            return undefined;
+        }
+        if (!cache || cache.mtimeMs !== mtimeMs)
+            cache = { mtimeMs, value: HubConfigStore.read() };
+        return cache.value;
+    }
+    static write(config) {
+        file_1.default.writeAtomic("HUB_FILE", JSON.stringify(config, null, 2));
+    }
+    static clear() {
+        file_1.default.remove("HUB_FILE");
+    }
+}
+exports.default = HubConfigStore;

package/dist/lib/links.js

@@ -0,0 +1,163 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinkError = exports.INVITE_TTL_MS = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+exports.INVITE_TTL_MS = 5 * 60000;
+class LinkError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.LinkError = LinkError;
+const sha256Hex = (value) => crypto_1.default.createHash("sha256").update(value).digest("hex");
+/** Constant-time compare of a stored hex digest against a fresh secret. */
+const matchesHash = (storedHex, secret) => {
+    const stored = Buffer.from(storedHex, "hex");
+    const candidate = Buffer.from(sha256Hex(secret), "hex");
+    return stored.length === candidate.length && crypto_1.default.timingSafeEqual(stored, candidate);
+};
+const load = () => {
+    const raw = file_1.default.read("LINKS_FILE");
+    if (!raw)
+        return { invites: [], peers: [] };
+    try {
+        const data = JSON.parse(raw);
+        return {
+            invites: Array.isArray(data?.invites) ? data.invites : [],
+            peers: Array.isArray(data?.peers) ? data.peers : [],
+        };
+    }
+    catch {
+        return { invites: [], peers: [] };
+    }
+};
+const save = (data) => {
+    file_1.default.writeAtomic("LINKS_FILE", JSON.stringify(data, null, 2));
+    fs_1.default.chmodSync(constants_1.default.paths.LINKS_FILE, 0o600);
+};
+const CODE_PATTERN = /^lnk_([0-9a-f]{8})\.(.+)$/i;
+const TOKEN_PATTERN = /^lpt_([0-9a-f]{8})\.(.+)$/i;
+class Links {
+    static createInvite(input) {
+        const id = crypto_1.default.randomBytes(4).toString("hex");
+        const secret = crypto_1.default.randomBytes(32).toString("base64url");
+        const now = new Date();
+        const invite = {
+            id,
+            codeHash: sha256Hex(secret),
+            role: input.role,
+            hosts: input.hosts,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + exports.INVITE_TTL_MS).toISOString(),
+        };
+        const data = load();
+        data.invites.push(invite);
+        save(data);
+        return { invite, code: `lnk_${id}.${secret}` };
+    }
+    static inviteString(baseUrl, code) {
+        return `${baseUrl.replace(/\/$/, "")}/#${code}`;
+    }
+    /** One-time: the invite is removed once a matching id is resolved, success or not. */
+    static redeem(code, name) {
+        const match = CODE_PATTERN.exec(String(code || "").trim());
+        if (!match)
+            throw new LinkError(401, "Invalid or expired code.");
+        const [, id, secret] = match;
+        const data = load();
+        const index = data.invites.findIndex((invite) => invite.id === id);
+        if (index === -1)
+            throw new LinkError(401, "Invalid or expired code.");
+        const invite = data.invites[index];
+        data.invites.splice(index, 1);
+        save(data);
+        if (Date.parse(invite.expiresAt) < Date.now())
+            throw new LinkError(401, "Invalid or expired code.");
+        if (!matchesHash(invite.codeHash, secret))
+            throw new LinkError(401, "Invalid or expired code.");
+        const peerId = crypto_1.default.randomBytes(4).toString("hex");
+        const tokenSecret = crypto_1.default.randomBytes(32).toString("base64url");
+        const peer = {
+            id: peerId,
+            name: String(name || "peer"),
+            role: invite.role,
+            hosts: invite.hosts,
+            tokenHash: sha256Hex(tokenSecret),
+            createdAt: new Date().toISOString(),
+        };
+        const fresh = load();
+        fresh.peers.push(peer);
+        save(fresh);
+        return { peer, token: `lpt_${peerId}.${tokenSecret}` };
+    }
+    /** Updates lastSeen at most once a minute so every proxied request doesn't rewrite the file. */
+    static authenticate(token) {
+        if (!token)
+            return undefined;
+        const match = TOKEN_PATTERN.exec(token.trim());
+        if (!match)
+            return undefined;
+        const [, id, secret] = match;
+        const data = load();
+        const peer = data.peers.find((p) => p.id === id);
+        if (!peer || !matchesHash(peer.tokenHash, secret))
+            return undefined;
+        const now = Date.now();
+        if (!peer.lastSeen || now - Date.parse(peer.lastSeen) >= 60000) {
+            peer.lastSeen = new Date(now).toISOString();
+            save(data);
+        }
+        return peer;
+    }
+    static list() {
+        const data = load();
+        const now = Date.now();
+        const invites = data.invites.filter((invite) => Date.parse(invite.expiresAt) >= now);
+        if (invites.length !== data.invites.length)
+            save({ ...data, invites });
+        return { invites, peers: data.peers };
+    }
+    static setRole(peerId, role, hosts) {
+        const data = load();
+        const peer = data.peers.find((p) => p.id === peerId);
+        if (!peer)
+            throw new LinkError(404, "Peer not found.");
+        peer.role = role;
+        peer.hosts = hosts;
+        save(data);
+        return peer;
+    }
+    static revoke(peerId) {
+        const data = load();
+        const peers = data.peers.filter((p) => p.id !== peerId);
+        if (peers.length !== data.peers.length)
+            save({ ...data, peers });
+    }
+    static revokeInvite(id) {
+        const data = load();
+        const invites = data.invites.filter((invite) => invite.id !== id);
+        if (invites.length !== data.invites.length)
+            save({ ...data, invites });
+    }
+    static can(peer, permission) {
+        if (permission === "read")
+            return true;
+        if (permission === "write")
+            return peer.role === "editor" || peer.role === "admin";
+        return peer.role === "admin"; // delete, settings
+    }
+    static visibleHosts(peer, all) {
+        if (peer.role !== "viewer")
+            return all;
+        const mine = new Set(peer.hosts || []);
+        return all.filter((host) => mine.has(host));
+    }
+}
+exports.default = Links;

package/dist/lib/localhost.js

@@ -76,7 +76,7 @@ class Localhost {
         return ["localhost", "127.0.0.1", "::1", "[::1]"].includes(hostname) || hostname.endsWith(".localhost");
     }
     /** Any HTTP response (even 404/500) counts as up: the upstream is reachable. */
-    static probe(target, timeoutMs = 1500, insecure = false) {
+    static probe(target, timeoutMs = 1500, insecure = false, headers = {}) {
         const started = Date.now();
         return new Promise((resolve) => {
             let url;
@@ -87,7 +87,7 @@ class Localhost {
                 return resolve({ up: false, error: "invalid target" });
             }
             const client = url.protocol === "https:" ? https_1.default : http_1.default;
-            const req = client.request(url, { method: "HEAD", timeout: timeoutMs, rejectUnauthorized: !insecure }, (res) => {
+            const req = client.request(url, { method: "HEAD", timeout: timeoutMs, rejectUnauthorized: !insecure, headers }, (res) => {
                 res.resume();
                 resolve({ up: true, status: res.statusCode, ms: Date.now() - started });
             });

package/dist/lib/proxy-control.js

@@ -52,14 +52,15 @@ class ProxyHandler {
         const child = (0, child_process_1.spawn)(command, args, {
             detached: true,
             stdio: ["ignore", logFd, logFd],
+            windowsHide: true,
             env: {
                 ...process.env,
                 LOCADOT_HOME: constants_1.default.paths.HOME,
                 LOCADOT_ROLE: "proxy",
                 LOCADOT_HTTP_PORT: String(constants_1.default.server.httpPort),
                 LOCADOT_HTTPS_PORT: String(constants_1.default.server.httpsPort),
+                LOCADOT_USER_PORTS: constants_1.default.userPortEnv(),
             },
-            windowsHide: true,
         });
         fs_1.default.closeSync(logFd);
         let exitCode = null;