locadot 2.1.0-beta.2 → 2.1.0-beta.3

package/CHANGELOG.md

@@ -35,6 +35,13 @@
 ### Fixed
 - The proxy can now tell a user's `LOCADOT_HTTP_PORT`/`LOCADOT_HTTPS_PORT` from the copies the CLI pins on every spawn
   (`LOCADOT_USER_PORTS`), so saved ports aren't reported as env-overridden.
+- `--cors` through remote access: a shared `--cors` mapping is now `--cors` on the receiver too (shown in `list` and the
+  dashboard, kept in step by `remote:sync` and `remote:update`). The sender used to rewrite its apps' origins in pages to its
+  *own* local URLs, which don't exist on the receiver. Now the receiver sends the names it uses (`X-Locadot-Names`), so a
+  page's API calls go to the receiver's name for that mapping (e.g. `api.alice.localhost` after a clash), on the receiver's
+  port. The upstream still sees the calling page's real origin. `<port>.<domain>.localhost` gets the CORS handling of a
+  `--cors` mapping on that port. The sender keeps names only for mappings the peer can see, and only as `*.localhost` URLs.
+  Both machines need this version for the rewriting; with an older receiver the sender behaves as before.
 
 ## 2.1.0-beta.0 (2026-09-27)
 

package/README.md

@@ -131,6 +131,12 @@ target, so an editor can reach anything the sender's machine can reach. Only giv
 of the tokens are stored, and failed attempts are rate limited. Only admins can open the sender's dashboard through the hub.
 The dashboard has **Remote access** and **Connected machines** cards for all of this.
 
+`--cors` carries over: a sender's `--cors` mapping is `--cors` on the receiver too, with no extra flag. Preflights and CORS
+headers work as they do locally, and origins in the sender's pages are rewritten to the receiver's own names and port (so
+`http://localhost:8000` in a page becomes `http://api.alice.localhost` if that's the receiver's name for `api.localhost`).
+An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` mapping points at that port.
+`remote:sync` picks up a sender turning `--cors` on or off.
+
 ### Certificates
 
 | Command | What it does |

package/dist/lib/remotes.js

@@ -91,6 +91,8 @@ const isDomainLabel = (value) => {
 exports.isDomainLabel = isDomainLabel;
 /** Sender allows the peer onto its localhost, treating an older sender (no `localhost` field) as "yes" when admin. */
 const localhostAllowed = (data, role) => typeof data.localhost === "boolean" ? data.localhost : role === "admin";
+/** A shared --cors mapping is --cors here too; the sender still does the CORS work (see router forwardRemote). */
+const inherited = (h) => (h.cors ? { cors: true } : {});
 /** Domains already spoken for: other remotes' `domain`, and any single-label `*.localhost` registry host. */
 const takenDomains = (excludeName) => {
     const store = readFile();
@@ -212,7 +214,7 @@ class Remotes {
                     continue;
                 }
                 taken.add(local);
-                registry.hosts[local] = { target: remote.url, remote: { name, host: h.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: remote.url, remote: { name, host: h.host }, ...inherited(h), createdAt: now, updatedAt: now };
                 mapped.push({ local, host: h.host });
             }
         });
@@ -244,9 +246,14 @@ class Remotes {
         const now = new Date().toISOString();
         await registry_1.default.mutate((registry) => {
             const already = new Set();
-            for (const entry of Object.values(registry.hosts)) {
-                if (entry.remote?.name === name)
-                    already.add(entry.remote.host);
+            const flags = new Map(hosts.map((h) => [h.host, h]));
+            for (const [local, entry] of Object.entries(registry.hosts)) {
+                if (entry.remote?.name !== name)
+                    continue;
+                already.add(entry.remote.host);
+                const h = flags.get(entry.remote.host);
+                if (h && Boolean(h.cors) !== Boolean(entry.cors))
+                    registry.hosts[local] = { ...entry, cors: h.cors || undefined };
             }
             const taken = new Set(Object.keys(registry.hosts));
             for (const h of hosts) {
@@ -256,7 +263,7 @@ class Remotes {
                 if (!local)
                     continue;
                 taken.add(local);
-                registry.hosts[local] = { target: updated.url, remote: { name, host: h.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: updated.url, remote: { name, host: h.host }, ...inherited(h), createdAt: now, updatedAt: now };
             }
         });
         const registry = registry_1.default.read();
@@ -270,13 +277,14 @@ class Remotes {
         const local = localhost_1.default.requireHost(localHost);
         const hostsRes = await call(`${apiBase(remote.url)}/hosts`, { token: remote.token });
         const hosts = hostsRes.hosts;
-        if (!hosts.some((h) => h.host === remoteHost))
+        const shared = hosts.find((h) => h.host === remoteHost);
+        if (!shared)
             throw new hosts_1.NotFoundError(`"${remoteHost}" is not available on "${name}".`);
         const now = new Date().toISOString();
         await registry_1.default.mutate((registry) => {
             if (registry.hosts[local])
                 throw new hosts_1.ConflictError(`❌ ${local} is already mapped to ${registry.hosts[local].target}.`);
-            registry.hosts[local] = { target: remote.url, remote: { name, host: remoteHost }, createdAt: now, updatedAt: now };
+            registry.hosts[local] = { target: remote.url, remote: { name, host: remoteHost }, ...inherited(shared), createdAt: now, updatedAt: now };
         });
     }
     static setUrl(name, url) {
@@ -329,7 +337,7 @@ class Remotes {
             const taken = new Set(Object.keys(registry.hosts));
             const local = Remotes.localName(name, created.host, taken);
             if (local)
-                registry.hosts[local] = { target: remote.url, remote: { name, host: created.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: remote.url, remote: { name, host: created.host }, ...inherited(created), createdAt: now, updatedAt: now };
         });
         return created;
     }
@@ -340,7 +348,14 @@ class Remotes {
             token: remote.token,
             body: input,
         });
-        return data.host;
+        const updated = data.host;
+        await registry_1.default.mutate((registry) => {
+            for (const [local, entry] of Object.entries(registry.hosts)) {
+                if (entry.remote?.name === name && entry.remote.host === host)
+                    registry.hosts[local] = { ...entry, cors: updated.cors || undefined };
+            }
+        });
+        return updated;
     }
     static async removeHost(name, host) {
         const remote = Remotes.mustGet(name);

package/dist/proxy/cors.js

@@ -24,12 +24,16 @@ exports.preflightHeaders = preflightHeaders;
 /**
  * --cors: the upstream should see a request from a site it trusts, so origin/CSRF checks pass.
  * A page on another mapped domain (signalsant.localhost calling api.signalsant.localhost) is
- * sent as that domain's real origin; anything else as the target's own origin.
+ * sent as that domain's real origin; anything else as the target's own origin. A peer's page is on the
+ * receiver's name for one of our domains, so it is matched by those names, never by our own.
  */
 const sameOriginHeaders = (req, entry, lookup) => {
+    const names = (0, request_1.peerNamesOf)(req);
+    const callerHost = (url) => names ? Object.keys(names).find((host) => new URL(names[host]).host === url.host) : url.hostname;
     const upstreamOrigin = (value) => {
         try {
-            const caller = lookup(new URL(value).hostname);
+            const host = callerHost(new URL(value));
+            const caller = host ? lookup(host) : undefined;
             if (caller)
                 return new URL(caller.target).origin;
         }

package/dist/proxy/hub.js

@@ -87,6 +87,39 @@ const receiverHost = (req) => {
     const match = /^([^:]+)(?::(\d{1,5}))?$/.exec(raw);
     return match && localhost_1.default.isValidLocalhostDomain(match[1]) ? raw : undefined;
 };
+const MAX_NAMES = 16 * 1024;
+/**
+ * `X-Locadot-Names` from the receiver: `<our host>=<its URL for it>,…`. Kept only for hosts this peer can see and
+ * `http(s)://*.localhost[:port]` URLs; they only ever end up in responses to that same peer.
+ */
+const peerNames = (req, visible) => {
+    const header = req.headers["x-locadot-names"];
+    if (typeof header !== "string" || header.length > MAX_NAMES)
+        return undefined;
+    const names = {};
+    for (const pair of header.split(",")) {
+        const [host, url] = pair.trim().toLowerCase().split("=");
+        const match = url ? /^https?:\/\/([^/:]+)(?::(\d{1,5}))?$/.exec(url) : null;
+        if (host && match && visible.includes(host) && localhost_1.default.isValidLocalhostDomain(match[1]))
+            names[host] = url;
+    }
+    return names;
+};
+/** Sender side: a --cors mapping whose target is this machine's `port`, so port access gets its cors too. */
+const corsMappingFor = (hosts, port) => Object.keys(hosts).find((host) => {
+    const entry = hosts[host];
+    if (!entry.cors || entry.remote)
+        return false;
+    try {
+        const url = new URL(entry.target);
+        const own = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+        return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) && own === port;
+    }
+    catch {
+        return false;
+    }
+});
+const ownHosts = (hosts, peer) => links_1.default.visibleHosts(peer, Object.keys(hosts)).filter((host) => !hosts[host].remote);
 const stripLocadotHeaders = (req) => {
     for (const name of Object.keys(req.headers))
         if (name.toLowerCase().startsWith("x-locadot-"))
@@ -127,7 +160,7 @@ function classify(req, publicHost, hosts, opts) {
             if (!origin)
                 return { kind: "deny", status: 400, message: "Bad request" };
             // Keep X-Locadot-Token: the dashboard page sends it on every mutating call.
-            for (const name of ["x-locadot-peer", "x-locadot-dashboard", "x-locadot-host", "x-locadot-port"])
+            for (const name of ["x-locadot-peer", "x-locadot-dashboard", "x-locadot-host", "x-locadot-port", "x-locadot-names"])
                 delete req.headers[name];
             return { kind: "dashboard", peer, origin };
         }
@@ -139,8 +172,15 @@ function classify(req, publicHost, hosts, opts) {
             return { kind: "deny", status: 400, message: "Bad request" };
         if (opts?.blockedPorts?.includes(port))
             return { kind: "deny", status: 403, message: "Forbidden" };
+        const names = req.headers["x-locadot-names"] === undefined ? undefined : peerNames(req, ownHosts(hosts, peer));
+        const host = corsMappingFor(hosts, port);
+        // The page stays on <port>.<domain>.localhost rather than moving to the receiver's name for the mapping.
+        const self = receiverHost(req);
+        const scheme = names && Object.values(names)[0]?.split(":")[0];
+        if (host && names && self && scheme)
+            names[host] = `${scheme}://${self}`;
         stripLocadotHeaders(req);
-        return { kind: "local", port, peer };
+        return { kind: "local", port, peer, names, host };
     }
     const hostHeader = req.headers["x-locadot-host"];
     const host = typeof hostHeader === "string" ? hostHeader.trim().toLowerCase() : "";
@@ -152,8 +192,9 @@ function classify(req, publicHost, hosts, opts) {
     if (!visible.includes(host)) {
         return { kind: "deny", status: 403, message: "Forbidden" };
     }
+    const names = req.headers["x-locadot-names"] === undefined ? undefined : peerNames(req, visible);
     stripLocadotHeaders(req);
-    return { kind: "app", host, peer };
+    return { kind: "app", host, peer, names };
 }
 /* ---------- /_locadot/v1 API ---------- */
 const send = (res, status, body) => {

package/dist/proxy/remote.js

@@ -32,7 +32,7 @@ const remotes = () => {
 };
 const remoteFor = (name) => remotes()[name];
 exports.remoteFor = remoteFor;
-const remoteOptions = (req, entry, remote) => ({
+const remoteOptions = (req, entry, remote, names) => ({
     target: remote.url,
     changeOrigin: true,
     // Don't leak the receiver's LAN addresses to the sender.
@@ -47,6 +47,7 @@ const remoteOptions = (req, entry, remote) => ({
         "X-Original-Host": req.headers.host || "",
         "X-Locadot-Peer": remote.token,
         "X-Locadot-Host": entry.remote.host,
+        ...(names ? { "X-Locadot-Names": names } : {}),
     },
 });
 exports.remoteOptions = remoteOptions;
@@ -75,7 +76,7 @@ exports.localFor = localFor;
 const canReachLocalhost = (remote) => remote.role === "admin" && remote.localhost !== false;
 exports.canReachLocalhost = canReachLocalhost;
 /** Without a port the sender serves its dashboard. */
-const localOptions = (req, remote, port) => ({
+const localOptions = (req, remote, port, names) => ({
     target: remote.url,
     changeOrigin: true,
     xfwd: false,
@@ -88,7 +89,7 @@ const localOptions = (req, remote, port) => ({
     headers: {
         "X-Original-Host": req.headers.host || "",
         "X-Locadot-Peer": remote.token,
-        ...(port ? { "X-Locadot-Port": String(port) } : { "X-Locadot-Dashboard": "1" }),
+        ...(port ? { "X-Locadot-Port": String(port), ...(names ? { "X-Locadot-Names": names } : {}) } : { "X-Locadot-Dashboard": "1" }),
     },
 });
 exports.localOptions = localOptions;

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -23,6 +23,8 @@ const fromRemote = (req) => Boolean(tags.get(req)?.remote);
 exports.fromRemote = fromRemote;
 const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
 exports.peerOriginOf = peerOriginOf;
+const peerNamesOf = (req) => tags.get(req)?.peerNames;
+exports.peerNamesOf = peerNamesOf;
 const viaOf = (req) => tags.get(req)?.via;
 exports.viaOf = viaOf;
 /** Tunnel visitors are on https even though cloudflared talks plain http to us. */

package/dist/proxy/response.js

@@ -23,7 +23,8 @@ const handleProxyResponse = (proxyRes, req, res, hosts, publicUrl = () => undefi
         return;
     stripHopByHop(proxyRes.headers);
     const entry = hosts[(0, request_1.mappedHost)(req)];
-    if (!entry?.cors)
+    // A remote mapping's cors flag is inherited: the sender already applied it.
+    if (!entry?.cors || entry.remote)
         return;
     (0, cors_1.applyCors)(req, proxyRes.headers);
     const via = (0, request_1.viaOf)(req);

package/dist/proxy/rewrite.js

@@ -25,9 +25,11 @@ const originMap = (req, hosts, publicUrl = () => undefined) => {
     const tls = (0, request_1.isTls)(req);
     const self = (0, request_1.mappedHost)(req);
     const tunnel = (0, request_1.fromTunnel)(req);
+    // A peer's browser knows our hosts by its own names; older receivers don't send them.
+    const peer = (0, request_1.peerNamesOf)(req);
     const pairs = [];
     for (const [host, entry] of Object.entries(hosts)) {
-        const local = tunnel ? publicUrl(host) : (0, urls_1.urlFor)(host, tls);
+        const local = tunnel ? publicUrl(host) : peer ? peer[host] : (0, urls_1.urlFor)(host, tls);
         if (!local)
             continue;
         try {

package/dist/proxy/router.js

@@ -20,7 +20,7 @@ const stats_1 = require("./stats");
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
 const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "app") {
-        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure() });
+        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names });
         return hub.host;
     }
     if (hub?.kind === "dashboard") {
@@ -28,8 +28,9 @@ const resolveHost = (req, ctx, hub) => {
         return "localhost";
     }
     if (hub?.kind === "local") {
-        const host = `localhost:${hub.port}`;
-        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure() });
+        // A port behind a --cors mapping is served as that mapping, cors included.
+        const host = hub.host ?? `localhost:${hub.port}`;
+        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names });
         return host;
     }
     const host = (0, request_1.hostOf)(req);
@@ -42,6 +43,16 @@ const dashboardUrl = (req) => `${(0, urls_1.urlFor)("localhost", (0, request_1.i
 const passThrough = (req, entry) => Boolean(entry.cors);
 /** Same-origin only, and a tunnel visitor may only reach public hosts (see guard.ts). */
 const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host));
+/**
+ * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
+ * its apps' origins to the names this machine uses rather than its own.
+ */
+const peerNames = (req, ctx, name) => (ctx.remoteHosts?.(name) || [])
+    .flatMap((local) => {
+    const host = ctx.lookup(local)?.remote?.host;
+    return host ? [`${host}=${(0, urls_1.urlFor)(local, (0, request_1.isTls)(req))}`] : [];
+})
+    .join(",");
 const reason = (err) => err?.code || err?.message;
 const remoteGone = (entry) => `the connection to ${entry.remote.name} was removed`;
 /** Sender side: an admin peer reaching one of this machine's ports. */
@@ -84,7 +95,7 @@ function handleRequest(req, res, ctx) {
             ctx.dashboard(req, res);
             return;
         }
-        const entry = hub?.kind === "local" ? localEntry(hub.port) : ctx.lookup(host);
+        const entry = hub?.kind === "local" && !hub.host ? localEntry(hub.port) : ctx.lookup(host);
         if (!entry) {
             const local = localTarget(req, ctx, host, hub);
             if (local) {
@@ -155,7 +166,7 @@ function forwardRemote(req, res, ctx, host, entry) {
     }
     const started = Date.now();
     res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
-    ctx.proxy.web(req, res, (0, remote_1.remoteOptions)(req, entry, remote), (err) => {
+    ctx.proxy.web(req, res, (0, remote_1.remoteOptions)(req, entry, remote, peerNames(req, ctx, remote.name)), (err) => {
         logger_1.default.warn(`${host} → ${remote.name} (${remote.url}): ${reason(err)}`);
         if (res.headersSent) {
             res.destroy();
@@ -182,7 +193,7 @@ function forwardLocal(req, res, ctx, host, local) {
     const label = `${remote.name}: ${port ? `localhost:${port}` : "dashboard"}`;
     const started = Date.now();
     res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
-    ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port), (err) => {
+    ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port, port ? peerNames(req, ctx, remote.name) : undefined), (err) => {
         logger_1.default.warn(`${host} → ${label}: ${reason(err)}`);
         if (res.headersSent) {
             res.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.1.0-beta.2",
+  "version": "2.1.0-beta.3",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",