locadot 2.1.0-beta.2 → 2.1.0-beta.4

package/CHANGELOG.md

@@ -33,8 +33,19 @@
   Senders must run this version too; an older sender answers `<domain>.localhost` with a 404.
 
 ### Fixed
+- `--cors` pages that call an API on a bare `localhost:<port>` (e.g. `VITE_SERVER_URL=http://localhost:3100`) now send those
+  calls through the page's own origin (`/__locadot/x/http/localhost:3100/…`) like any other cross-origin call. Opened through
+  remote access, the API used to be called on the *viewer's* localhost, where it doesn't exist. A peer's pass-through reaches
+  the sender's localhost only with localhost access (admin, `hub:localhost on`), and never the proxy's own ports.
 - The proxy can now tell a user's `LOCADOT_HTTP_PORT`/`LOCADOT_HTTPS_PORT` from the copies the CLI pins on every spawn
   (`LOCADOT_USER_PORTS`), so saved ports aren't reported as env-overridden.
+- `--cors` through remote access: a shared `--cors` mapping is now `--cors` on the receiver too (shown in `list` and the
+  dashboard, kept in step by `remote:sync` and `remote:update`). The sender used to rewrite its apps' origins in pages to its
+  *own* local URLs, which don't exist on the receiver. Now the receiver sends the names it uses (`X-Locadot-Names`), so a
+  page's API calls go to the receiver's name for that mapping (e.g. `api.alice.localhost` after a clash), on the receiver's
+  port. The upstream still sees the calling page's real origin. `<port>.<domain>.localhost` gets the CORS handling of a
+  `--cors` mapping on that port. The sender keeps names only for mappings the peer can see, and only as `*.localhost` URLs.
+  Both machines need this version for the rewriting; with an older receiver the sender behaves as before.
 
 ## 2.1.0-beta.0 (2026-09-27)
 

package/README.md

@@ -131,6 +131,12 @@ target, so an editor can reach anything the sender's machine can reach. Only giv
 of the tokens are stored, and failed attempts are rate limited. Only admins can open the sender's dashboard through the hub.
 The dashboard has **Remote access** and **Connected machines** cards for all of this.
 
+`--cors` carries over: a sender's `--cors` mapping is `--cors` on the receiver too, with no extra flag. Preflights and CORS
+headers work as they do locally, and origins in the sender's pages are rewritten to the receiver's own names and port (so
+`http://localhost:8000` in a page becomes `http://api.alice.localhost` if that's the receiver's name for `api.localhost`).
+An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` mapping points at that port.
+`remote:sync` picks up a sender turning `--cors` on or off.
+
 ### Certificates
 
 | Command | What it does |
@@ -289,6 +295,8 @@ locadot add --host signalsant.localhost --target https://signalsant.com --cors
   `XMLHttpRequest`, `EventSource`, `WebSocket` and `sendBeacon` calls to other origins through the page's own origin
   (`/__locadot/x/https/api.signalsant.com/…`). The browser sees a same-origin request, so CORS never applies, and locadot
   forwards it with `Origin: https://signalsant.com`. Only the page itself can use it: requests from other sites get a 403.
+  Calls to a bare `localhost:<port>` (an API or dev server next to the app) go the same way, so the page works when opened
+  from another machine through remote access too. There, only admin peers reach the sender's localhost this way.
 - **Cookies.** The page's cookies are forwarded only to the same site (`api.signalsant.com`), never to third parties.
   Cookies set by third parties are dropped.
 - **Mapped domains.** If you also map a domain (`api.signalsant.localhost` → `https://api.signalsant.com --cors`), its URLs in

package/dist/lib/remotes.js

@@ -91,6 +91,8 @@ const isDomainLabel = (value) => {
 exports.isDomainLabel = isDomainLabel;
 /** Sender allows the peer onto its localhost, treating an older sender (no `localhost` field) as "yes" when admin. */
 const localhostAllowed = (data, role) => typeof data.localhost === "boolean" ? data.localhost : role === "admin";
+/** A shared --cors mapping is --cors here too; the sender still does the CORS work (see router forwardRemote). */
+const inherited = (h) => (h.cors ? { cors: true } : {});
 /** Domains already spoken for: other remotes' `domain`, and any single-label `*.localhost` registry host. */
 const takenDomains = (excludeName) => {
     const store = readFile();
@@ -212,7 +214,7 @@ class Remotes {
                     continue;
                 }
                 taken.add(local);
-                registry.hosts[local] = { target: remote.url, remote: { name, host: h.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: remote.url, remote: { name, host: h.host }, ...inherited(h), createdAt: now, updatedAt: now };
                 mapped.push({ local, host: h.host });
             }
         });
@@ -244,9 +246,14 @@ class Remotes {
         const now = new Date().toISOString();
         await registry_1.default.mutate((registry) => {
             const already = new Set();
-            for (const entry of Object.values(registry.hosts)) {
-                if (entry.remote?.name === name)
-                    already.add(entry.remote.host);
+            const flags = new Map(hosts.map((h) => [h.host, h]));
+            for (const [local, entry] of Object.entries(registry.hosts)) {
+                if (entry.remote?.name !== name)
+                    continue;
+                already.add(entry.remote.host);
+                const h = flags.get(entry.remote.host);
+                if (h && Boolean(h.cors) !== Boolean(entry.cors))
+                    registry.hosts[local] = { ...entry, cors: h.cors || undefined };
             }
             const taken = new Set(Object.keys(registry.hosts));
             for (const h of hosts) {
@@ -256,7 +263,7 @@ class Remotes {
                 if (!local)
                     continue;
                 taken.add(local);
-                registry.hosts[local] = { target: updated.url, remote: { name, host: h.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: updated.url, remote: { name, host: h.host }, ...inherited(h), createdAt: now, updatedAt: now };
             }
         });
         const registry = registry_1.default.read();
@@ -270,13 +277,14 @@ class Remotes {
         const local = localhost_1.default.requireHost(localHost);
         const hostsRes = await call(`${apiBase(remote.url)}/hosts`, { token: remote.token });
         const hosts = hostsRes.hosts;
-        if (!hosts.some((h) => h.host === remoteHost))
+        const shared = hosts.find((h) => h.host === remoteHost);
+        if (!shared)
             throw new hosts_1.NotFoundError(`"${remoteHost}" is not available on "${name}".`);
         const now = new Date().toISOString();
         await registry_1.default.mutate((registry) => {
             if (registry.hosts[local])
                 throw new hosts_1.ConflictError(`❌ ${local} is already mapped to ${registry.hosts[local].target}.`);
-            registry.hosts[local] = { target: remote.url, remote: { name, host: remoteHost }, createdAt: now, updatedAt: now };
+            registry.hosts[local] = { target: remote.url, remote: { name, host: remoteHost }, ...inherited(shared), createdAt: now, updatedAt: now };
         });
     }
     static setUrl(name, url) {
@@ -329,7 +337,7 @@ class Remotes {
             const taken = new Set(Object.keys(registry.hosts));
             const local = Remotes.localName(name, created.host, taken);
             if (local)
-                registry.hosts[local] = { target: remote.url, remote: { name, host: created.host }, createdAt: now, updatedAt: now };
+                registry.hosts[local] = { target: remote.url, remote: { name, host: created.host }, ...inherited(created), createdAt: now, updatedAt: now };
         });
         return created;
     }
@@ -340,7 +348,14 @@ class Remotes {
             token: remote.token,
             body: input,
         });
-        return data.host;
+        const updated = data.host;
+        await registry_1.default.mutate((registry) => {
+            for (const [local, entry] of Object.entries(registry.hosts)) {
+                if (entry.remote?.name === name && entry.remote.host === host)
+                    registry.hosts[local] = { ...entry, cors: updated.cors || undefined };
+            }
+        });
+        return updated;
     }
     static async removeHost(name, host) {
         const remote = Remotes.mustGet(name);

package/dist/proxy/cors.js

@@ -24,12 +24,16 @@ exports.preflightHeaders = preflightHeaders;
 /**
  * --cors: the upstream should see a request from a site it trusts, so origin/CSRF checks pass.
  * A page on another mapped domain (signalsant.localhost calling api.signalsant.localhost) is
- * sent as that domain's real origin; anything else as the target's own origin.
+ * sent as that domain's real origin; anything else as the target's own origin. A peer's page is on the
+ * receiver's name for one of our domains, so it is matched by those names, never by our own.
  */
 const sameOriginHeaders = (req, entry, lookup) => {
+    const names = (0, request_1.peerNamesOf)(req);
+    const callerHost = (url) => names ? Object.keys(names).find((host) => new URL(names[host]).host === url.host) : url.hostname;
     const upstreamOrigin = (value) => {
         try {
-            const caller = lookup(new URL(value).hostname);
+            const host = callerHost(new URL(value));
+            const caller = host ? lookup(host) : undefined;
             if (caller)
                 return new URL(caller.target).origin;
         }

package/dist/proxy/guard.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicOnlyAgents = exports.isPublicHost = exports.isPublicAddress = void 0;
+exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
 const dns_1 = __importDefault(require("dns"));
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
@@ -54,6 +54,17 @@ const isPublicAddress = (address) => {
     return net_1.default.isIPv6(address) && !blocked.check(address, "ipv6");
 };
 exports.isPublicAddress = isPublicAddress;
+/** localhost, *.localhost, 127.0.0.0/8, ::1 or 0.0.0.0: this machine itself. */
+const isLoopbackHost = (host) => {
+    const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
+    if (name === "localhost" || name.endsWith(".localhost"))
+        return true;
+    const v4 = net_1.default.isIPv4(name) ? name : net_1.default.isIPv6(name) ? embeddedV4(name) : undefined;
+    if (v4)
+        return v4.startsWith("127.") || v4 === "0.0.0.0";
+    return name === "::1" || name === "::";
+};
+exports.isLoopbackHost = isLoopbackHost;
 /** A host the pass-through may call for a tunnel visitor, judged before any DNS lookup. */
 const isPublicHost = (host) => {
     const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();

package/dist/proxy/hub.js

@@ -87,6 +87,39 @@ const receiverHost = (req) => {
     const match = /^([^:]+)(?::(\d{1,5}))?$/.exec(raw);
     return match && localhost_1.default.isValidLocalhostDomain(match[1]) ? raw : undefined;
 };
+const MAX_NAMES = 16 * 1024;
+/**
+ * `X-Locadot-Names` from the receiver: `<our host>=<its URL for it>,…`. Kept only for hosts this peer can see and
+ * `http(s)://*.localhost[:port]` URLs; they only ever end up in responses to that same peer.
+ */
+const peerNames = (req, visible) => {
+    const header = req.headers["x-locadot-names"];
+    if (typeof header !== "string" || header.length > MAX_NAMES)
+        return undefined;
+    const names = {};
+    for (const pair of header.split(",")) {
+        const [host, url] = pair.trim().toLowerCase().split("=");
+        const match = url ? /^https?:\/\/([^/:]+)(?::(\d{1,5}))?$/.exec(url) : null;
+        if (host && match && visible.includes(host) && localhost_1.default.isValidLocalhostDomain(match[1]))
+            names[host] = url;
+    }
+    return names;
+};
+/** Sender side: a --cors mapping whose target is this machine's `port`, so port access gets its cors too. */
+const corsMappingFor = (hosts, port) => Object.keys(hosts).find((host) => {
+    const entry = hosts[host];
+    if (!entry.cors || entry.remote)
+        return false;
+    try {
+        const url = new URL(entry.target);
+        const own = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+        return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) && own === port;
+    }
+    catch {
+        return false;
+    }
+});
+const ownHosts = (hosts, peer) => links_1.default.visibleHosts(peer, Object.keys(hosts)).filter((host) => !hosts[host].remote);
 const stripLocadotHeaders = (req) => {
     for (const name of Object.keys(req.headers))
         if (name.toLowerCase().startsWith("x-locadot-"))
@@ -127,7 +160,7 @@ function classify(req, publicHost, hosts, opts) {
             if (!origin)
                 return { kind: "deny", status: 400, message: "Bad request" };
             // Keep X-Locadot-Token: the dashboard page sends it on every mutating call.
-            for (const name of ["x-locadot-peer", "x-locadot-dashboard", "x-locadot-host", "x-locadot-port"])
+            for (const name of ["x-locadot-peer", "x-locadot-dashboard", "x-locadot-host", "x-locadot-port", "x-locadot-names"])
                 delete req.headers[name];
             return { kind: "dashboard", peer, origin };
         }
@@ -139,8 +172,15 @@ function classify(req, publicHost, hosts, opts) {
             return { kind: "deny", status: 400, message: "Bad request" };
         if (opts?.blockedPorts?.includes(port))
             return { kind: "deny", status: 403, message: "Forbidden" };
+        const names = req.headers["x-locadot-names"] === undefined ? undefined : peerNames(req, ownHosts(hosts, peer));
+        const host = corsMappingFor(hosts, port);
+        // The page stays on <port>.<domain>.localhost rather than moving to the receiver's name for the mapping.
+        const self = receiverHost(req);
+        const scheme = names && Object.values(names)[0]?.split(":")[0];
+        if (host && names && self && scheme)
+            names[host] = `${scheme}://${self}`;
         stripLocadotHeaders(req);
-        return { kind: "local", port, peer };
+        return { kind: "local", port, peer, names, host, loopback: opts?.blockedPorts ?? [] };
     }
     const hostHeader = req.headers["x-locadot-host"];
     const host = typeof hostHeader === "string" ? hostHeader.trim().toLowerCase() : "";
@@ -152,8 +192,11 @@ function classify(req, publicHost, hosts, opts) {
     if (!visible.includes(host)) {
         return { kind: "deny", status: 403, message: "Forbidden" };
     }
+    const names = req.headers["x-locadot-names"] === undefined ? undefined : peerNames(req, visible);
     stripLocadotHeaders(req);
-    return { kind: "app", host, peer };
+    // A --cors page's pass-through calls to localhost:<port> reach this machine only for peers allowed its localhost.
+    const loopback = links_1.default.can(peer, "localhost") && opts?.localhost !== false ? opts?.blockedPorts ?? [] : undefined;
+    return { kind: "app", host, peer, names, loopback };
 }
 /* ---------- /_locadot/v1 API ---------- */
 const send = (res, status, body) => {

package/dist/proxy/passthrough.js

@@ -56,12 +56,16 @@ exports.shimScript = `(() => {
   if (window.__locadotShim) return;
   window.__locadotShim = true;
   const VIA = ${JSON.stringify(VIA)};
+  const portOf = (url) => url.port || (url.protocol === "https:" || url.protocol === "wss:" ? "443" : "80");
   const route = (input) => {
     try {
       const url = new URL(String(input), location.href);
       if (!/^(https?|wss?):$/.test(url.protocol)) return null;
-      const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-      if (local || url.host === location.host) return null;
+      if (url.hostname.endsWith(".localhost") || url.host === location.host) return null;
+      // Bare localhost:<port> (an app's API or dev server) exists only where the app runs, so it goes through the
+      // page's origin too; a remote viewer's own localhost doesn't have it. The page's own proxy port stays direct.
+      const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+      if (loopback && portOf(url) === portOf(location)) return null;
       const ws = url.protocol === "ws:" || url.protocol === "wss:";
       const base = ws ? (location.protocol === "https:" ? "wss://" : "ws://") + location.host : location.origin;
       return base + VIA + url.protocol.slice(0, -1) + "/" + url.host + url.pathname + url.search + url.hash;
@@ -150,7 +154,7 @@ const rewriteViaResponse = (headers, via, target) => {
         else {
             try {
                 const url = new URL(location, `${via.scheme}://${via.host}/`);
-                if (/^https?:$/.test(url.protocol) && !/(^|\.)localhost$/.test(url.hostname))
+                if (/^https?:$/.test(url.protocol) && !url.hostname.endsWith(".localhost"))
                     headers.location = (0, exports.viaPath)(url) + url.hash;
             }
             catch { }

package/dist/proxy/remote.js

@@ -32,7 +32,7 @@ const remotes = () => {
 };
 const remoteFor = (name) => remotes()[name];
 exports.remoteFor = remoteFor;
-const remoteOptions = (req, entry, remote) => ({
+const remoteOptions = (req, entry, remote, names) => ({
     target: remote.url,
     changeOrigin: true,
     // Don't leak the receiver's LAN addresses to the sender.
@@ -47,6 +47,7 @@ const remoteOptions = (req, entry, remote) => ({
         "X-Original-Host": req.headers.host || "",
         "X-Locadot-Peer": remote.token,
         "X-Locadot-Host": entry.remote.host,
+        ...(names ? { "X-Locadot-Names": names } : {}),
     },
 });
 exports.remoteOptions = remoteOptions;
@@ -75,7 +76,7 @@ exports.localFor = localFor;
 const canReachLocalhost = (remote) => remote.role === "admin" && remote.localhost !== false;
 exports.canReachLocalhost = canReachLocalhost;
 /** Without a port the sender serves its dashboard. */
-const localOptions = (req, remote, port) => ({
+const localOptions = (req, remote, port, names) => ({
     target: remote.url,
     changeOrigin: true,
     xfwd: false,
@@ -88,7 +89,7 @@ const localOptions = (req, remote, port) => ({
     headers: {
         "X-Original-Host": req.headers.host || "",
         "X-Locadot-Peer": remote.token,
-        ...(port ? { "X-Locadot-Port": String(port) } : { "X-Locadot-Dashboard": "1" }),
+        ...(port ? { "X-Locadot-Port": String(port), ...(names ? { "X-Locadot-Names": names } : {}) } : { "X-Locadot-Dashboard": "1" }),
     },
 });
 exports.localOptions = localOptions;

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -23,6 +23,10 @@ const fromRemote = (req) => Boolean(tags.get(req)?.remote);
 exports.fromRemote = fromRemote;
 const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
 exports.peerOriginOf = peerOriginOf;
+const peerNamesOf = (req) => tags.get(req)?.peerNames;
+exports.peerNamesOf = peerNamesOf;
+const loopbackOf = (req) => tags.get(req)?.loopback;
+exports.loopbackOf = loopbackOf;
 const viaOf = (req) => tags.get(req)?.via;
 exports.viaOf = viaOf;
 /** Tunnel visitors are on https even though cloudflared talks plain http to us. */

package/dist/proxy/response.js

@@ -23,7 +23,8 @@ const handleProxyResponse = (proxyRes, req, res, hosts, publicUrl = () => undefi
         return;
     stripHopByHop(proxyRes.headers);
     const entry = hosts[(0, request_1.mappedHost)(req)];
-    if (!entry?.cors)
+    // A remote mapping's cors flag is inherited: the sender already applied it.
+    if (!entry?.cors || entry.remote)
         return;
     (0, cors_1.applyCors)(req, proxyRes.headers);
     const via = (0, request_1.viaOf)(req);

package/dist/proxy/rewrite.js

@@ -25,9 +25,11 @@ const originMap = (req, hosts, publicUrl = () => undefined) => {
     const tls = (0, request_1.isTls)(req);
     const self = (0, request_1.mappedHost)(req);
     const tunnel = (0, request_1.fromTunnel)(req);
+    // A peer's browser knows our hosts by its own names; older receivers don't send them.
+    const peer = (0, request_1.peerNamesOf)(req);
     const pairs = [];
     for (const [host, entry] of Object.entries(hosts)) {
-        const local = tunnel ? publicUrl(host) : (0, urls_1.urlFor)(host, tls);
+        const local = tunnel ? publicUrl(host) : peer ? peer[host] : (0, urls_1.urlFor)(host, tls);
         if (!local)
             continue;
         try {

package/dist/proxy/router.js

@@ -20,7 +20,7 @@ const stats_1 = require("./stats");
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
 const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "app") {
-        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure() });
+        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return hub.host;
     }
     if (hub?.kind === "dashboard") {
@@ -28,8 +28,9 @@ const resolveHost = (req, ctx, hub) => {
         return "localhost";
     }
     if (hub?.kind === "local") {
-        const host = `localhost:${hub.port}`;
-        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure() });
+        // A port behind a --cors mapping is served as that mapping, cors included.
+        const host = hub.host ?? `localhost:${hub.port}`;
+        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return host;
     }
     const host = (0, request_1.hostOf)(req);
@@ -40,8 +41,26 @@ const resolveHost = (req, ctx, hub) => {
 };
 const dashboardUrl = (req) => `${(0, urls_1.urlFor)("localhost", (0, request_1.isTls)(req))}/`;
 const passThrough = (req, entry) => Boolean(entry.cors);
-/** Same-origin only, and a tunnel visitor may only reach public hosts (see guard.ts). */
-const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host));
+/** A hub peer reaches this machine's localhost:<port> only with localhost access, and never the proxy's own ports. */
+const peerMayReach = (req, via) => {
+    if (!(0, request_1.fromRemote)(req) || !(0, guard_1.isLoopbackHost)(via.host))
+        return true;
+    const allowed = (0, request_1.loopbackOf)(req);
+    const port = Number(via.host.match(/:(\d+)$/)?.[1] || (via.scheme === "https" || via.scheme === "wss" ? 443 : 80));
+    return Boolean(allowed && !allowed.includes(port));
+};
+/** Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost. */
+const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via);
+/**
+ * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
+ * its apps' origins to the names this machine uses rather than its own.
+ */
+const peerNames = (req, ctx, name) => (ctx.remoteHosts?.(name) || [])
+    .flatMap((local) => {
+    const host = ctx.lookup(local)?.remote?.host;
+    return host ? [`${host}=${(0, urls_1.urlFor)(local, (0, request_1.isTls)(req))}`] : [];
+})
+    .join(",");
 const reason = (err) => err?.code || err?.message;
 const remoteGone = (entry) => `the connection to ${entry.remote.name} was removed`;
 /** Sender side: an admin peer reaching one of this machine's ports. */
@@ -84,7 +103,7 @@ function handleRequest(req, res, ctx) {
             ctx.dashboard(req, res);
             return;
         }
-        const entry = hub?.kind === "local" ? localEntry(hub.port) : ctx.lookup(host);
+        const entry = hub?.kind === "local" && !hub.host ? localEntry(hub.port) : ctx.lookup(host);
         if (!entry) {
             const local = localTarget(req, ctx, host, hub);
             if (local) {
@@ -155,7 +174,7 @@ function forwardRemote(req, res, ctx, host, entry) {
     }
     const started = Date.now();
     res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
-    ctx.proxy.web(req, res, (0, remote_1.remoteOptions)(req, entry, remote), (err) => {
+    ctx.proxy.web(req, res, (0, remote_1.remoteOptions)(req, entry, remote, peerNames(req, ctx, remote.name)), (err) => {
         logger_1.default.warn(`${host} → ${remote.name} (${remote.url}): ${reason(err)}`);
         if (res.headersSent) {
             res.destroy();
@@ -182,7 +201,7 @@ function forwardLocal(req, res, ctx, host, local) {
     const label = `${remote.name}: ${port ? `localhost:${port}` : "dashboard"}`;
     const started = Date.now();
     res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
-    ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port), (err) => {
+    ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port, port ? peerNames(req, ctx, remote.name) : undefined), (err) => {
         logger_1.default.warn(`${host} → ${label}: ${reason(err)}`);
         if (res.headersSent) {
             res.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.1.0-beta.2",
+  "version": "2.1.0-beta.4",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",