locadot 2.1.0-beta.4 → 2.2.0

package/CHANGELOG.md

@@ -1,6 +1,26 @@
 # Changelog
 
-## Unreleased
+## 2.2.0 (2026-09-29)
+
+### Added
+- Share the dashboard in a browser: `locadot hub:panel on` (or **Share this dashboard** under Remote access) serves the
+  control panel at the hub's public URL, behind the dashboard password. It can't be turned on without a password, and
+  removing the password turns it off. The visitor's browser never gets the API token; sign-in is rate limited per visitor IP.
+  `GET /api/hub` reports `panel`; `PUT /api/hub/panel` turns it on or off.
+
+### Fixed
+- Start at boot on macOS: `sudo locadot startup:enable` wrote a LaunchAgent into root's home, which never runs; it now
+  installs a LaunchDaemon that starts at boot, before login, as the sudo user with their state dir. Without sudo, the
+  LaunchAgent (starts at login) now clears a disabled override left by an earlier `startup:disable`, carries port
+  overrides, escapes paths, and survives a dashboard restart. Enabling or disabling no longer stops a running proxy.
+- `locadot trust` on macOS failed with "The authorization was denied since no user interaction was possible". It ran
+  `security` through an osascript admin prompt, which can't show the trust-settings dialog macOS requires; it now runs
+  `sudo security` in the terminal (or `security` directly from the dashboard). `sudo locadot trust` is refused on macOS,
+  since it trusted root's CA rather than the one the proxy serves.
+- Through a tunnel or remote access, a stopped or unmapped upstream is now a 503 with locadot's "upstream unreachable"
+  page. With 502, Cloudflare replaced the page with its own "origin bad gateway" error, which hid the real cause.
+
+## 2.1.0 (2026-09-27)
 
 ### Added
 - Dashboard pages: every sidebar item now opens its own page (`#/overview`, `#/hosts`, `#/sharing`, `#/remote`, `#/machines`,

package/README.md

@@ -20,6 +20,11 @@ HTTPS custom domains for local development. Point `https://app.localhost` at you
   (`--target https://google.com`). Redirects and cookies are rewritten so the browser stays on the `.localhost` name.
 - 🌍 **Share on a public URL.** `locadot tunnel --host app.localhost` (or **Share** in the dashboard) puts a mapping on
   `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed.
+- 🔗 **Remote access, locadot to locadot.** Publish your whole locadot on a Cloudflare hostname and let other machines pair
+  with it as viewer, editor or admin. Your mappings show up in their locadot. Admins can also open your dashboard and any
+  port on your localhost.
+- 🖥️ **Share the dashboard in a browser.** `locadot hub:panel on` serves the control panel at the hub's public URL, behind the
+  dashboard password, so you can manage this machine from anywhere without installing locadot there.
 - 🧩 **`--cors` for sites that call other domains.** Preflights are answered locally and cross-origin calls are routed
   through the page's own origin, so a production frontend works against its real APIs from `.localhost`.
 - 📋 **Control panel at `https://localhost`.** Add, edit, filter and remove mappings, see health and traffic, share them,
@@ -110,8 +115,10 @@ short-lived pairing string, and the sender's mappings then show up in the receiv
 | --- | --- |
 | `locadot hub:setup --domain dev.example.com` | Sender: publish through your own named tunnel on your Cloudflare domain (runs `cloudflared` login, creates the tunnel and routes DNS). The address stays the same. |
 | `locadot hub:quick` | Sender: publish on a trycloudflare URL. No account is needed, but **the URL changes if the tunnel restarts**, so receivers have to run `remote:url`. |
+| `locadot hub:manual --url <url>` | Sender: publish behind a URL something else already forwards to the proxy's HTTP port (ngrok, a reverse proxy). |
 | `locadot hub` / `hub:off` | Show the hub status and URL, or stop it. |
 | `locadot hub:localhost <on\|off>` | Sender: allow or block admin peers from opening this machine's dashboard and any port on its localhost. |
+| `locadot hub:panel <on\|off>` | Sender: serve this dashboard to any browser at the hub's public URL, behind the [dashboard password](#dashboard-password). Off by default. See [Sharing the dashboard](#sharing-the-dashboard-in-a-browser). |
 | `locadot share --role viewer\|editor\|admin [--hosts a.localhost,b.localhost]` | Sender: print a pairing string. It works once and expires after 5 minutes. `--hosts` limits a viewer to those mappings. |
 | `locadot peers` / `peers:role <id> <role>` / `peers:revoke <id>` | Sender: list the connected machines, change a role, or cut one off. |
 | `locadot connect "<pairing string>" [--name alice] [--domain dev]` | Receiver: connect and import the sender's mappings. If a name clashes, `app.localhost` becomes `app.alice.localhost`. Admins get a local domain that opens the sender's dashboard and localhost (see below); `--domain` picks it, otherwise it's a random `adjective-noun`. |
@@ -137,6 +144,31 @@ headers work as they do locally, and origins in the sender's pages are rewritten
 An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` mapping points at that port.
 `remote:sync` picks up a sender turning `--cors` on or off.
 
+When a target is down, requests through the hub or a public share get a **503** with locadot's "upstream unreachable" page.
+Cloudflare replaces an origin's 502 with its own generic "bad gateway" error, which would hide the real cause.
+
+#### Sharing the dashboard in a browser
+
+Remote access above needs locadot on both machines. To manage this machine from a browser anywhere (a laptop, a phone),
+share the dashboard itself on the hub's public URL:
+
+```sh
+locadot ui:password     # required: visitors sign in with it
+locadot hub:panel on    # or the "Share this dashboard" switch under Remote access
+locadot hub             # shows the URL, e.g. https://dev.example.com
+```
+
+Opening the hub URL in a browser then shows the sign-in page, and after that the full dashboard. Paired machines keep
+working on the same URL, since they authenticate with their own tokens. Some details:
+
+- It can't be turned on without a dashboard password, and removing the password turns sharing off.
+- The session cookie is `HttpOnly`, `SameSite=Strict` and `Secure` on https. Wrong passwords are rate limited per visitor IP.
+- The browser never gets this machine's API token. Changes are only accepted from the page's own origin.
+- Only the dashboard is shared. Your mappings stay reachable only by paired machines, and links in the dashboard still point
+  at `*.localhost` names, which open on the visitor's own machine.
+- Anyone with the password controls this locadot, including remote access and stopping the proxy. Use a strong one, or
+  prefer a named tunnel (`hub:setup`) behind Cloudflare Access if you need more.
+
 ### Certificates
 
 | Command | What it does |
@@ -152,7 +184,7 @@ An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` m
 | `locadot clear:logs` | Clear the log file. |
 | `locadot path` | Show every file locadot uses. `path:logs` and `path:hosts` print a single path. |
 | `locadot token` | Print the dashboard API token, for scripts and AI agents. |
-| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (a hidden script in the Windows Startup folder, no admin needed). |
+| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron; macOS LaunchDaemon with `sudo`, running as you) or logon (macOS LaunchAgent without `sudo`; a hidden script in the Windows Startup folder, no admin needed). |
 
 ---
 
@@ -184,6 +216,8 @@ hosts become cards:
 Trust and start-at-boot may need elevation. locadot asks the OS for it (polkit on Linux, the password dialog on macOS, UAC on Windows).
 If that isn't possible, for example on a headless Linux box, the panel shows the exact command to run instead: `sudo locadot trust`,
 `locadot startup:enable`, and so on.
+On macOS, run `locadot trust` without `sudo`: it asks for your password itself, and macOS then confirms the trust change in a
+dialog, which only works in Terminal on the Mac, not over SSH. Under `sudo` it would trust root's own CA instead of yours.
 
 ### Dashboard password
 
@@ -196,6 +230,7 @@ echo "$PW" | locadot ui:password --stdin
 ```
 
 You can also set, change or remove it under **Settings → Dashboard password** (changing or removing it there needs the current one).
+It's also what [sharing the dashboard in a browser](#sharing-the-dashboard-in-a-browser) signs visitors in with.
 Only the dashboard is protected. Your mapped hosts work as before, and so do scripts and the CLI that send `X-Locadot-Token`.
 Sessions last 7 days, and changing the password signs everyone out. If you forget it, run `locadot ui:password` again in a terminal.
 
@@ -221,8 +256,9 @@ each time the proxy starts.
 | `PUT /api/settings` | `{ "httpPort": 8080, "httpsPort": 8443 }` | Save new ports to the config file (400 if invalid or equal). Takes effect after a restart. |
 | `POST /api/proxy/restart` | | Restart the proxy (e.g. to pick up saved ports). |
 | `PUT /api/settings/ui-password` | `{ "password": "…", "current": "…" }` or `{ "enabled": false, "current": "…" }` | Set, change or remove the dashboard password (`current` is required once one is set). |
-| `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on). |
+| `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on) and `panel` (is the dashboard shared). |
 | `PUT /api/hub/localhost` | `{ "enabled": true }` | Sender: turn localhost access for admin peers on/off (400 if the hub isn't configured). |
+| `PUT /api/hub/panel` | `{ "enabled": true }` | Sender: share the dashboard at the hub's public URL on/off (400 if the hub isn't configured, or no dashboard password is set). |
 | `GET /api/remotes` | | Every remote (never the token), including `domain` and `localhost`. |
 | `POST /api/remotes` | `{ "string": "<pairing string>", "name": "alice", "domain": "dev" }` | Receiver: connect using a pairing string; `domain` is optional (admin only, random if omitted). |
 | `PUT /api/remotes/:name` | `{ "domain": "dev" }` or `{ "domain": "random" }` or `{ "domain": null }` | Receiver: set, randomize or remove a remote's local domain (400 invalid, 409 clash, 404 unknown). |

package/dist/cli/commands/remote.js

@@ -9,6 +9,7 @@ exports.hubQuick = hubQuick;
 exports.hubManual = hubManual;
 exports.hubOff = hubOff;
 exports.hubLocalhost = hubLocalhost;
+exports.hubPanel = hubPanel;
 exports.share = share;
 exports.peers = peers;
 exports.peersRole = peersRole;
@@ -102,7 +103,7 @@ const getHub = async () => {
 };
 const HUB_EMOJI = { off: "🔒", starting: "⏳", up: "🌍", error: "❌", login: "🔑" };
 async function hub(options) {
-    const { hub } = await getHub();
+    const { hub, panel } = await getHub();
     if (options.json) {
         console.log(JSON.stringify(hub, null, 2));
         return;
@@ -116,6 +117,8 @@ async function hub(options) {
         (0, shared_1.print)(`   Open to finish login: ${hub.loginUrl}`);
     if (hub.error)
         (0, shared_1.print)(`   ${hub.error}`);
+    if (panel)
+        (0, shared_1.print)(`   Dashboard shared${hub.url ? ` at ${hub.url}` : ""} (password sign-in). Turn off: locadot hub:panel off`);
 }
 async function hubSetup(options) {
     if (!options.domain)
@@ -172,6 +175,23 @@ async function hubLocalhost(value) {
         throw new localhost_1.InputError(`❌ Couldn't update (${status})${json?.error ? `: ${json.error}` : ""}.`);
     (0, shared_1.print)(json.localhost ? "🖥️  Admin peers can now reach this machine's localhost." : "🔒 Admin peers can no longer reach this machine's localhost.");
 }
+async function hubPanel(value) {
+    if (value !== "on" && value !== "off")
+        throw new localhost_1.InputError('❌ Use "on" or "off".');
+    requireRunning();
+    const { status, json } = await dashboardRequest("PUT", "/api/hub/panel", {
+        headers: { "X-Locadot-Token": apiToken() },
+        body: { enabled: value === "on" },
+    });
+    if (status === 400)
+        throw new localhost_1.InputError(`❌ ${json?.error || "Set up the hub first: locadot hub:setup / hub:quick / hub:manual."}${json?.hint ? ` ${json.hint}` : ""}`);
+    if (status !== 200)
+        throw new localhost_1.InputError(`❌ Couldn't update (${status})${json?.error ? `: ${json.error}` : ""}.`);
+    if (!json.panel)
+        return (0, shared_1.print)("🔒 The dashboard is no longer shared.");
+    const { hub } = await getHub();
+    (0, shared_1.print)(`🌍 The dashboard is shared${hub.url ? ` at ${hub.url}` : ""}. Visitors sign in with the dashboard password.`);
+}
 async function share(options) {
     const role = requireRole(options.role);
     if (options.hosts && role !== "viewer") {

package/dist/dashboard/api.js

@@ -321,6 +321,7 @@ function buildHubBody(ctx) {
         hub: ctx.hub(),
         config: config ?? null,
         localhost: config?.localhost !== false,
+        panel: config?.panel === true,
         invites: invites.map(sanitizeInvite),
         peers: peers.map(sanitizePeer),
     };
@@ -355,6 +356,7 @@ async function route(req, url, ctx) {
         (["/api/startup", "/api/trust", "/api/logs/clear", "/api/proxy/stop", "/api/proxy/restart", "/api/cloudflared/install", "/api/hub", "/api/invites", "/api/remotes"].includes(path) &&
             method === "POST") ||
         (path === "/api/hub/localhost" && method === "PUT") ||
+        (path === "/api/hub/panel" && method === "PUT") ||
         (path === "/api/settings" && method === "PUT") ||
         (inviteMatch && method === "DELETE") ||
         (peerMatch && (method === "PUT" || method === "DELETE")) ||
@@ -467,6 +469,17 @@ async function route(req, url, ctx) {
             ctx.reloadHub();
             return { status: 200, body: { localhost: enabled } };
         }
+        if (path === "/api/hub/panel" && method === "PUT") {
+            const enabled = requiredBool(body.enabled, "enabled");
+            const config = hub_config_1.default.read();
+            if (!config)
+                throw new ApiError(400, "The hub isn't configured yet. Set it up first: locadot hub:setup / hub:quick / hub:manual.");
+            if (enabled && !ui_auth_1.default.enabled())
+                throw new ApiError(400, "Set a dashboard password first.", "Settings → Dashboard password, or `locadot ui:password`.");
+            hub_config_1.default.write({ ...config, panel: enabled });
+            ctx.reloadHub();
+            return { status: 200, body: { panel: enabled } };
+        }
         if (path === "/api/invites" && method === "POST") {
             if (!isRole(body.role))
                 throw new ApiError(400, "`role` must be viewer, editor or admin.");

package/dist/dashboard/index.js

@@ -177,7 +177,7 @@ function handleDashboardRequest(req, res, ctx) {
 async function uiPassword(req, res, ctx) {
     (0, api_1.assertTrusted)(req, ctx);
     const body = await (0, api_1.readJson)(req);
-    const ip = req.socket.remoteAddress || "";
+    const ip = (0, login_1.loginIp)(req);
     if (ui_auth_1.default.enabled()) {
         if (ui_auth_1.default.limited(ip))
             throw new api_1.ApiError(429, "Too many wrong passwords. Wait a few minutes and try again.");

package/dist/dashboard/login.js

@@ -36,13 +36,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionCookie = exports.signedIn = void 0;
+exports.sessionCookie = exports.signedIn = exports.loginIp = void 0;
 exports.gate = gate;
 const crypto_1 = __importDefault(require("crypto"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const escape_1 = require("./escape");
 const api_1 = require("./api");
 const ui_auth_1 = __importStar(require("../lib/ui-auth"));
+const request_1 = require("../proxy/request");
+const hub_1 = require("../proxy/hub");
 const MAX_LOGIN_BODY = 4096;
 const loginPage = (nonce, error) => `<!doctype html>
 <html lang="en">
@@ -90,7 +92,9 @@ const safeEqual = (a, b) => {
     const y = Buffer.from(b);
     return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
 };
-const isTls = (req) => Boolean(req.socket.encrypted);
+/** Through the shared dashboard every visitor arrives from cloudflared on loopback, so limit by the visitor's IP. */
+const loginIp = (req) => ((0, request_1.isPanel)(req) ? (0, hub_1.clientIp)(req) : req.socket.remoteAddress || "");
+exports.loginIp = loginIp;
 const sameOrigin = (req) => {
     // Browsers send `Origin: null` on form posts under Referrer-Policy: no-referrer, so trust Sec-Fetch-Site when present.
     // "same-site" is refused: every *.localhost app is same-site with the dashboard.
@@ -102,7 +106,9 @@ const sameOrigin = (req) => {
         return !origin;
     return (0, api_1.isDashboardOrigin)(req, origin);
 };
-const cookie = (req, value, maxAge) => `${ui_auth_1.SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${isTls(req) ? "; Secure" : ""}`;
+// The shared dashboard's public URL is https even though cloudflared talks plain http to us.
+const secure = (req) => ((0, request_1.isPanel)(req) ? (0, request_1.isTls)(req) : Boolean(req.socket.encrypted));
+const cookie = (req, value, maxAge) => `${ui_auth_1.SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure(req) ? "; Secure" : ""}`;
 const sendLogin = (res, method, nonce, status, error) => {
     // The dashboard's CSP forbids form posts; the login form needs one.
     res.setHeader("Content-Security-Policy", `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`);
@@ -149,8 +155,13 @@ exports.sessionCookie = sessionCookie;
  * are let through untouched. Returns true when it answered the request itself.
  */
 function gate(req, res, url, token, nonce) {
-    if (!ui_auth_1.default.enabled())
-        return false;
+    if (!ui_auth_1.default.enabled()) {
+        if (!(0, request_1.isPanel)(req))
+            return false;
+        res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("locadot: set a dashboard password to share the dashboard.\n");
+        return true;
+    }
     const method = req.method || "GET";
     const path = url.pathname;
     if (path === "/login") {
@@ -162,7 +173,7 @@ function gate(req, res, url, token, nonce) {
         }
         if (method !== "POST")
             return false;
-        const ip = req.socket.remoteAddress || "";
+        const ip = (0, exports.loginIp)(req);
         if (!sameOrigin(req)) {
             sendLogin(res, method, nonce, 403, "Cross-site sign-in is not allowed.");
             return true;

package/dist/dashboard/page.js

@@ -1061,6 +1061,10 @@ const clientJs = `
   var connectDomainInput = document.getElementById("connect-domain");
   var hubLocalhostRow = document.getElementById("hub-localhost-row");
   var hubLocalhostSwitch = document.getElementById("hub-localhost");
+  var hubPanelRow = document.getElementById("hub-panel-row");
+  var hubPanelSwitch = document.getElementById("hub-panel");
+  var hubPanelSub = document.getElementById("hub-panel-sub");
+  var hubPanelUrl = "";
   var connectSubmitBtn = document.getElementById("connect-submit");
   var connectErrorEl = document.getElementById("connect-error");
   var remotesEmptyEl = document.getElementById("remotes-empty");
@@ -1509,6 +1513,9 @@ const clientJs = `
 
     hubLocalhostRow.hidden = !data.config;
     setSwitch(hubLocalhostSwitch, data.localhost !== false);
+    hubPanelUrl = status === "up" && hub.url ? hub.url : "";
+    hubPanelRow.hidden = !data.config;
+    renderHubPanel(data.panel === true);
 
     hubErrorRow.hidden = !(status === "error" && hub.error);
     if (status === "error" && hub.error) hubErrorRow.textContent = hub.error;
@@ -1874,6 +1881,29 @@ const clientJs = `
     return row;
   }
 
+  function renderHubPanel(on) {
+    setSwitch(hubPanelSwitch, on);
+    // Turning it on needs a password; turning it off never does.
+    hubPanelSwitch.disabled = !on && !UI_AUTH;
+    if (!UI_AUTH && !on) hubPanelSub.textContent = "Set a dashboard password in Settings first. Visitors sign in with it.";
+    else if (on) hubPanelSub.textContent = "Open " + (hubPanelUrl || "the public URL") + " in any browser and sign in with the dashboard password.";
+    else hubPanelSub.textContent = "Open this dashboard from any browser at the public URL, after signing in with the dashboard password.";
+  }
+
+  hubPanelSwitch.addEventListener("click", function () {
+    var next = hubPanelSwitch.getAttribute("aria-checked") !== "true";
+    hubPanelSwitch.disabled = true;
+    apiFetch("/api/hub/panel", { method: "PUT", body: JSON.stringify({ enabled: next }) })
+      .then(function () {
+        renderHubPanel(next);
+        showToast(next ? "The dashboard is shared at the public URL" : "The dashboard is no longer shared", "success");
+      })
+      .catch(function (err) {
+        apiError(err, "Couldn't change dashboard sharing");
+        renderHubPanel(!next);
+      });
+  });
+
   hubLocalhostSwitch.addEventListener("click", function () {
     var next = hubLocalhostSwitch.getAttribute("aria-checked") !== "true";
     hubLocalhostSwitch.disabled = true;
@@ -2962,6 +2992,7 @@ const clientJs = `
     uiAuthSave.textContent = enabled ? "Change password" : "Set password";
     uiAuthRemove.hidden = !enabled;
     signOutBtn.hidden = !enabled;
+    renderHubPanel(enabled && hubPanelSwitch.getAttribute("aria-checked") === "true");
   }
   renderUiAuth(UI_AUTH);
 
@@ -3314,6 +3345,13 @@ function renderPage(nonce, token, uiAuth = false) {
             </div>
             <button type="button" id="hub-localhost" class="switch" role="switch" aria-checked="true" aria-label="Let admins open this dashboard and any port on this machine"><span class="switch-knob"></span></button>
           </div>
+          <div id="hub-panel-row" class="toggle-row" hidden>
+            <div>
+              <div class="label">Share this dashboard</div>
+              <div id="hub-panel-sub" class="tile-sub"></div>
+            </div>
+            <button type="button" id="hub-panel" class="switch" role="switch" aria-checked="false" aria-label="Share this dashboard at the public URL, behind the dashboard password"><span class="switch-knob"></span></button>
+          </div>
         </div>
 
         <div id="hub-share-section" class="hub-section" hidden>

package/dist/index.js

@@ -136,6 +136,10 @@ program
     .command("hub:localhost <onOrOff>")
     .description("Sender: let admin peers reach any port on this machine's localhost (on/off)")
     .action(run((value) => commands_1.default.hubLocalhost(value)));
+program
+    .command("hub:panel <onOrOff>")
+    .description("Sender: open this dashboard to browsers at the hub's public URL, behind the dashboard password (on/off)")
+    .action(run((value) => commands_1.default.hubPanel(value)));
 program
     .command("ui:password")
     .description("Set or reset the dashboard password (prompts; hashed with scrypt). The API token keeps working for scripts")

package/dist/lib/ui-auth.js

@@ -9,6 +9,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const constants_1 = __importDefault(require("../constants"));
 const file_1 = __importDefault(require("../utils/file"));
+const hub_config_1 = __importDefault(require("./hub-config"));
 exports.SESSION_COOKIE = "locadot_ui";
 exports.SESSION_TTL_SEC = 7 * 24 * 3600;
 exports.MIN_PASSWORD = 8;
@@ -68,6 +69,10 @@ class UiAuth {
     static clear() {
         file_1.default.remove("UI_AUTH_FILE");
         cache = undefined;
+        // The shared dashboard needs the password, so it doesn't come back on its own when a new one is set.
+        const hub = hub_config_1.default.read();
+        if (hub?.panel)
+            hub_config_1.default.write({ ...hub, panel: false });
     }
     static verify(password) {
         const data = UiAuth.read();

package/dist/proxy/hub.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetRateLimiter = void 0;
+exports.clientIp = exports.resetRateLimiter = void 0;
 exports.classify = classify;
 exports.handleHubApi = handleHubApi;
 const os_1 = __importDefault(require("os"));
@@ -45,6 +45,7 @@ const logger_1 = __importDefault(require("../utils/logger"));
 const links_1 = __importStar(require("../lib/links"));
 const hosts_1 = __importStar(require("../lib/hosts"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
 const localhost_1 = __importStar(require("../lib/localhost"));
 const registry_1 = require("../lib/registry");
 const request_1 = require("./request");
@@ -80,6 +81,7 @@ const clientIp = (req) => {
     const value = Array.isArray(header) ? header[0] : header;
     return value || req.socket.remoteAddress || "unknown";
 };
+exports.clientIp = clientIp;
 /** `X-Original-Host` from the receiver, only if it is a `*.localhost` name with an optional port. */
 const receiverHost = (req) => {
     const header = req.headers["x-original-host"];
@@ -137,7 +139,13 @@ function classify(req, publicHost, hosts, opts) {
     const pathname = (req.url || "/").split("?")[0];
     if (pathname === "/_locadot" || pathname.startsWith("/_locadot/"))
         return { kind: "api" };
-    const ip = clientIp(req);
+    // Peers always send X-Locadot-Peer; a plain browser gets the shared dashboard, which has its own sign-in limiter.
+    if (opts?.panel && req.headers["x-locadot-peer"] === undefined) {
+        if (!ui_auth_1.default.enabled())
+            return { kind: "deny", status: 403, message: "Set a dashboard password to share the dashboard." };
+        return { kind: "panel" };
+    }
+    const ip = (0, exports.clientIp)(req);
     if (isLimited(ip))
         return { kind: "deny", status: 429, message: "Too many failed attempts. Try again later." };
     // Not Authorization: the sender's own apps may need that header from the visitor.
@@ -269,7 +277,7 @@ async function handleHubApi(req, res, ctx) {
     const url = new URL(req.url || "/", "http://hub.invalid");
     const path = url.pathname;
     const method = req.method || "GET";
-    const ip = clientIp(req);
+    const ip = (0, exports.clientIp)(req);
     try {
         if (path === "/_locadot/v1/connect" && method === "POST") {
             const body = await readJson(req);

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.isPanel = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -21,6 +21,8 @@ const fromTunnel = (req) => Boolean(tags.get(req)?.tunnel);
 exports.fromTunnel = fromTunnel;
 const fromRemote = (req) => Boolean(tags.get(req)?.remote);
 exports.fromRemote = fromRemote;
+const isPanel = (req) => Boolean(tags.get(req)?.panel);
+exports.isPanel = isPanel;
 const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
 exports.peerOriginOf = peerOriginOf;
 const peerNamesOf = (req) => tags.get(req)?.peerNames;

package/dist/proxy/router.js

@@ -17,12 +17,18 @@ const guard_1 = require("./guard");
 const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
+// Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
+const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
 const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "app") {
         (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return hub.host;
     }
+    if (hub?.kind === "panel") {
+        (0, request_1.tag)(req, { host: "localhost", remote: true, secure: ctx.hub.secure(), peerOrigin: (req.headers.host || "").toLowerCase(), panel: true });
+        return "localhost";
+    }
     if (hub?.kind === "dashboard") {
         (0, request_1.tag)(req, { host: "localhost", remote: true, secure: ctx.hub.secure(), peerOrigin: hub.origin });
         return "localhost";
@@ -110,7 +116,7 @@ function handleRequest(req, res, ctx) {
                 forwardLocal(req, res, ctx, host, local);
                 return;
             }
-            res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+            res.writeHead(downStatus(req), { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
             res.end((0, template_1.proxyNotFound)(host, dashboardUrl(req)));
             return;
         }
@@ -152,8 +158,8 @@ function handleRequest(req, res, ctx) {
                 res.destroy();
                 return;
             }
-            // With --cors the page should see a 502, not a CORS error.
-            res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? (0, cors_1.allowOrigin)(req) : {}) });
+            // With --cors the page should see the error, not a CORS failure.
+            res.writeHead(downStatus(req), { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? (0, cors_1.allowOrigin)(req) : {}) });
             res.end((0, template_1.upstreamDown)(host, upstream, reason(err) || "error", dashboardUrl(req)));
         });
     }
@@ -207,13 +213,13 @@ function forwardLocal(req, res, ctx, host, local) {
             res.destroy();
             return;
         }
-        html(res, 502, (0, template_1.upstreamDown)(host, label, reason(err) || "error", dashboardUrl(req)));
+        html(res, downStatus(req), (0, template_1.upstreamDown)(host, label, reason(err) || "error", dashboardUrl(req)));
     });
 }
 function handleUpgrade(req, socket, head, ctx) {
     socket.on("error", () => socket.destroy());
     const hub = ctx.hub?.classify(req);
-    if (hub?.kind === "api" || hub?.kind === "deny") {
+    if (hub?.kind === "api" || hub?.kind === "deny" || hub?.kind === "panel") {
         const status = hub.kind === "deny" ? hub.status : 400;
         socket.end(`HTTP/1.1 ${status} ${http_1.default.STATUS_CODES[status] || "Error"}\r\nConnection: close\r\n\r\n`);
         return;

package/dist/server/index.js

@@ -76,6 +76,7 @@ async function startCentralProxy() {
         hub: {
             classify: (req) => (0, hub_1.classify)(req, hub.publicHost(), registry.get().hosts, {
                 localhost: hub_config_1.default.readCached()?.localhost !== false,
+                panel: hub_config_1.default.readCached()?.panel === true,
                 blockedPorts: [info.httpPort, info.httpsPort],
             }),
             api: (req, res) => {

package/dist/utils/startup.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.windowsLauncherScript = void 0;
+exports.windowsLauncherScript = exports.macPlist = exports.macDirs = void 0;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_1 = __importDefault(require("fs"));
@@ -16,11 +16,87 @@ const SERVICE_NAME = "locadot-proxy";
 const MAC_LABEL = "com.locadot.proxy";
 const CRON_MARK = "# locadot-proxy";
 const MARKER = path_1.default.join(constants_1.default.paths.HOME, "startup.json");
+const markerIn = (state) => path_1.default.join(state, "startup.json");
 // Per-user Startup folder: unlike an ONLOGON scheduled task it needs no admin rights.
 const windowsLauncher = () => path_1.default.join(process.env.APPDATA || path_1.default.join(os_1.default.homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup", `${SERVICE_NAME}.vbs`);
 // Earlier versions registered an ONLOGON scheduled task and kept the script in the state dir.
 const LEGACY_LAUNCHER = path_1.default.join(constants_1.default.paths.HOME, "startup-hidden.vbs");
-const plistPath = () => path_1.default.join(os_1.default.homedir(), "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+// Tests point these elsewhere.
+exports.macDirs = { daemons: "/Library/LaunchDaemons" };
+const agentPath = (home = os_1.default.homedir()) => path_1.default.join(home, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+const daemonPath = () => path_1.default.join(exports.macDirs.daemons, `${MAC_LABEL}.plist`);
+const xml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+/** Home of the user behind `sudo`, so root mode starts their proxy, not root's. */
+const sudoUserHome = (user) => {
+    try {
+        const out = (0, child_process_1.execFileSync)("dscl", [".", "-read", `/Users/${user}`, "NFSHomeDirectory"], { encoding: "utf8", windowsHide: true });
+        const home = out.split(":").slice(1).join(":").trim();
+        if (home)
+            return home;
+    }
+    catch { }
+    return path_1.default.join("/Users", user);
+};
+/**
+ * Who the boot job runs as and which state dir it uses. As root under plain `sudo`, HOME is /var/root, so the
+ * state dir is re-derived for SUDO_USER; LOCADOT_HOME or `sudo -E` already point at the right one.
+ */
+const macTarget = () => {
+    const root = process.getuid?.() === 0;
+    const user = root ? process.env.SUDO_USER : undefined;
+    if (!user || user === "root")
+        return { root, user: undefined, home: os_1.default.homedir(), state: constants_1.default.paths.HOME };
+    const home = sudoUserHome(user);
+    const own = process.env.LOCADOT_HOME || constants_1.default.paths.HOME.startsWith(`${home}/`);
+    return { root, user, home, state: own ? constants_1.default.paths.HOME : path_1.default.join(home, "Library", "Application Support", "locadot") };
+};
+const macPlist = (label, argv, opts) => {
+    const env = { ...(opts.home ? { HOME: opts.home } : {}), ...opts.env };
+    const dict = (entries) => Object.entries(entries).map(([k, v]) => `    <key>${xml(k)}</key>\n    <string>${xml(v)}</string>`).join("\n");
+    const log = path_1.default.join(opts.state, ".locadot.log");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    ${argv.map((arg) => `<string>${xml(arg)}</string>`).join("\n    ")}
+  </array>${opts.user ? `\n  <key>UserName</key>\n  <string>${xml(opts.user)}</string>` : ""}${Object.keys(env).length ? `\n  <key>EnvironmentVariables</key>\n  <dict>\n${dict(env)}\n  </dict>` : ""}
+  <key>RunAtLoad</key>
+  <true/>
+  <!-- A dashboard restart spawns the new proxy and exits; launchd must not take it down with the old one. -->
+  <key>AbandonProcessGroup</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xml(log)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml(log)}</string>
+</dict>
+</plist>
+`;
+};
+exports.macPlist = macPlist;
+/** Port vars only when the user set them; otherwise the proxy reads the ports saved in the state dir. */
+const userPortVars = () => {
+    const set = constants_1.default.userPortEnv();
+    if (set === "none")
+        return {};
+    const vars = { LOCADOT_USER_PORTS: set };
+    if (set.includes("LOCADOT_HTTP_PORT"))
+        vars.LOCADOT_HTTP_PORT = String(constants_1.default.server.httpPort);
+    if (set.includes("LOCADOT_HTTPS_PORT"))
+        vars.LOCADOT_HTTPS_PORT = String(constants_1.default.server.httpsPort);
+    return vars;
+};
+/** Clears a disabled override (left by `launchctl unload -w`), which would keep the job from ever running. */
+const launchctlEnable = (domain) => {
+    try {
+        (0, child_process_1.execFileSync)("launchctl", ["enable", `${domain}/${MAC_LABEL}`], { stdio: "ignore", windowsHide: true });
+    }
+    catch { }
+};
 const quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 // Resolved on use, not import: the entry path depends on how locadot was launched.
 const launchArgs = () => {
@@ -102,30 +178,40 @@ class Startup {
                 break;
             }
             case "mac": {
-                // macOS (10.14+) lets unprivileged processes bind 80/443, so a user LaunchAgent is enough.
-                const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${MAC_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-    ${[command, ...args].map((arg) => `<string>${arg}</string>`).join("\n    ")}
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>StandardOutPath</key>
-  <string>${constants_1.default.paths.LOGS}</string>
-  <key>StandardErrorPath</key>
-  <string>${constants_1.default.paths.LOGS}</string>
-</dict>
-</plist>`;
-                fs_1.default.mkdirSync(path_1.default.dirname(plistPath()), { recursive: true });
-                fs_1.default.writeFileSync(plistPath(), plist);
-                (0, child_process_1.execFileSync)("launchctl", ["load", "-w", plistPath()], { stdio: "inherit", windowsHide: true });
-                method = "launch-agent";
-                break;
+                // Not loaded now: a second proxy would only fail to bind next to the running one. launchd reads
+                // LaunchAgents at login and LaunchDaemons at boot on its own.
+                const target = macTarget();
+                const argv = [command, ...args.slice(0, -1), target.state];
+                if (target.root) {
+                    // Root mode: a LaunchDaemon starts at boot, before anyone logs in, as the sudo user when there is one.
+                    fs_1.default.mkdirSync(exports.macDirs.daemons, { recursive: true });
+                    fs_1.default.writeFileSync(daemonPath(), (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, user: target.user, home: target.user ? target.home : undefined, env: userPortVars() }));
+                    // launchd skips daemon plists that aren't root-owned or are group/world writable.
+                    fs_1.default.chmodSync(daemonPath(), 0o644);
+                    fs_1.default.rmSync(agentPath(target.home), { force: true });
+                    launchctlEnable("system");
+                    method = "launch-daemon";
+                }
+                else {
+                    // macOS (10.14+) lets unprivileged processes bind 80/443, so a user LaunchAgent is enough. It starts at login.
+                    fs_1.default.mkdirSync(path_1.default.dirname(agentPath()), { recursive: true });
+                    fs_1.default.writeFileSync(agentPath(), (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, env: userPortVars() }));
+                    fs_1.default.chmodSync(agentPath(), 0o644);
+                    if (fs_1.default.existsSync(daemonPath()))
+                        await execSudo(`rm -f ${quote(daemonPath())}`);
+                    launchctlEnable(`gui/${process.getuid?.()}`);
+                    method = "launch-agent";
+                }
+                fs_1.default.mkdirSync(target.state, { recursive: true });
+                fs_1.default.writeFileSync(markerIn(target.state), JSON.stringify({ platform, method, enabledAt: new Date().toISOString() }, null, 2));
+                if (target.user) {
+                    // Written as root into the user's state dir; the user's own proxy has to be able to replace them.
+                    const { uid, gid } = fs_1.default.statSync(target.home);
+                    for (const file of [target.state, markerIn(target.state)])
+                        fs_1.default.chownSync(file, uid, gid);
+                }
+                logger_1.default.info(`✅ locadot will start at ${method === "launch-daemon" ? "boot" : "login"} (${method}).`);
+                return;
             }
             default:
                 throw new Error("Unknown platform");
@@ -148,15 +234,19 @@ class Startup {
                 else
                     (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit", windowsHide: true });
                 break;
-            case "mac":
-                if (fs_1.default.existsSync(plistPath())) {
-                    try {
-                        (0, child_process_1.execFileSync)("launchctl", ["unload", "-w", plistPath()], { stdio: "ignore", windowsHide: true });
-                    }
-                    catch { }
-                    fs_1.default.rmSync(plistPath(), { force: true });
+            case "mac": {
+                // Only the plist goes: unloading the job would also stop a proxy launchd started.
+                const target = macTarget();
+                fs_1.default.rmSync(agentPath(target.home), { force: true });
+                if (fs_1.default.existsSync(daemonPath())) {
+                    if (target.root)
+                        fs_1.default.rmSync(daemonPath(), { force: true });
+                    else
+                        await execSudo(`rm -f ${quote(daemonPath())}`);
                 }
+                fs_1.default.rmSync(markerIn(target.state), { force: true });
                 break;
+            }
             default:
                 throw new Error("Unknown platform");
         }
@@ -188,7 +278,7 @@ class Startup {
                         return true;
                     return (0, child_process_1.execFileSync)("sh", ["-c", "crontab -l 2>/dev/null || true"], { encoding: "utf8", windowsHide: true }).includes(CRON_MARK);
                 case "mac":
-                    return fs_1.default.existsSync(plistPath());
+                    return fs_1.default.existsSync(agentPath()) || fs_1.default.existsSync(daemonPath());
                 case "windows":
                     return fs_1.default.existsSync(windowsLauncher());
                 default:

package/dist/utils/trust.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.macSecurity = macSecurity;
 exports.isCATrusted = isCATrusted;
 exports.trustCA = trustCA;
 exports.untrustCA = untrustCA;
@@ -126,11 +127,60 @@ function isTrustedLinux(certPath) {
         return false;
     }
 }
+const MAC_KEYCHAIN = "/Library/Keychains/System.keychain";
+const macRootError = () => new Error(`Run \`locadot trust\` without sudo; it asks for your password itself. Under sudo it would trust root's own CA ` +
+    `(${(0, certs_1.caCertPath)()}), not the one your proxy serves.`);
+// Plain `sudo` sets HOME to /var/root; `sudo -E` or LOCADOT_HOME keep the user's state dir, so those are fine.
+const sudoAsRoot = () => {
+    const user = process.env.SUDO_USER;
+    return process.getuid?.() === 0 && Boolean(user) && !process.env.LOCADOT_HOME && !path_1.default.resolve(constants_1.default.paths.HOME).startsWith(`/Users/${user}/`);
+};
+// Changing admin trust settings needs macOS to show a password dialog. sudo-prompt elevates through
+// `osascript ... with administrator privileges`, which can't, so it fails with "no user interaction was possible".
+// A Terminal's sudo or the user's own session can.
+// Async: from the dashboard the dialog can stay open for a while, and the proxy has to keep serving meanwhile.
+async function macSecurity(args) {
+    const viaSudo = process.getuid?.() !== 0 && Boolean(process.stdin.isTTY);
+    const detail = await new Promise((resolve) => {
+        const child = viaSudo
+            ? (0, child_process_1.spawn)("sudo", ["security", ...args], { stdio: ["inherit", "inherit", "pipe"], windowsHide: true })
+            : (0, child_process_1.spawn)("security", args, { stdio: ["ignore", "inherit", "pipe"], windowsHide: true });
+        let stderr = "";
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+            if (viaSudo)
+                process.stderr.write(chunk);
+        });
+        child.on("error", (error) => resolve(error.message));
+        child.on("close", (code) => resolve(code === 0 ? undefined : stderr.trim() || `security exited with ${code}`));
+    });
+    if (detail === undefined)
+        return;
+    if (/no user interaction was possible/i.test(detail)) {
+        throw new Error("macOS needs to show a password dialog to change certificate trust, and couldn't from here. " +
+            "Run `locadot trust` in Terminal on the Mac itself (not over SSH), or run:\n  " +
+            `sudo security ${args.map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ")}`);
+    }
+    throw new Error(detail);
+}
 async function trustMac(certPath) {
-    await execSudo(`security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`);
+    if (sudoAsRoot())
+        throw macRootError();
+    await macSecurity(["add-trusted-cert", "-d", "-r", "trustRoot", "-k", MAC_KEYCHAIN, certPath]);
 }
 async function untrustMac() {
-    await execSudo(`security delete-certificate -c "${CA_NAME}"`);
+    if (sudoAsRoot())
+        throw macRootError();
+    const certPath = (0, certs_1.caCertPath)();
+    if (fs_1.default.existsSync(certPath)) {
+        try {
+            await macSecurity(["remove-trusted-cert", "-d", certPath]);
+        }
+        catch {
+            // No trust settings left for it; deleting the certificate below is what matters.
+        }
+    }
+    await macSecurity(["delete-certificate", "-c", CA_NAME, MAC_KEYCHAIN]);
 }
 function isTrustedMac(certPath) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.1.0-beta.4",
+  "version": "2.2.0",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",