locadot 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2.3.0 (2026-09-29)
+
+### Added
+- Share on your own hostname: `locadot tunnel --host app.localhost --domain app.example.com`, or **Share** in the
+  dashboard and choose **Custom domain**. Runs a named Cloudflare tunnel for the mapping (login once, the DNS record is
+  created for you), so the URL doesn't change. `PUT /api/hosts/:host {"tunnel": true, "domain": "…"}`.
+- The dashboard no longer uses the browser's confirm and prompt boxes; confirmations and inputs open in-app dialogs.
+- Internal access for shared mappings: `locadot allow --host app.localhost localhost:3000` (or **Access** on a row in the
+  dashboard) lets tunnel visitors and connected machines, viewers included, reach the listed internal addresses through
+  that `--cors` domain's pass-through. Normally they're limited to public hosts. locadot's own ports stay blocked.
+  `add --allow`, `PUT /api/hosts/:host {"allow": [...]}`.
+
 ## 2.2.0 (2026-09-29)
 
 ### Added

package/README.md

@@ -19,7 +19,8 @@ HTTPS custom domains for local development. Point `https://app.localhost` at you
 - 🔁 **Any destination.** A local port (`--port 3000`), a host and port (`--target 192.168.1.5:8080`), or any URL
   (`--target https://google.com`). Redirects and cookies are rewritten so the browser stays on the `.localhost` name.
 - 🌍 **Share on a public URL.** `locadot tunnel --host app.localhost` (or **Share** in the dashboard) puts a mapping on
-  `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed.
+  `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed. Or put it on your own
+  hostname (`--domain app.example.com`) through a named tunnel in your Cloudflare account, with a URL that never changes.
 - 🔗 **Remote access, locadot to locadot.** Publish your whole locadot on a Cloudflare hostname and let other machines pair
   with it as viewer, editor or admin. Your mappings show up in their locadot. Admins can also open your dashboard and any
   port on your localhost.
@@ -64,6 +65,7 @@ npx locadot open                                    # opens the dashboard at htt
 | `locadot add --host <name>.localhost --target <url>` | Map a domain to any upstream: `3000`, `127.0.0.1:8080`, `http://10.0.0.5:8080/app`, `https://google.com`. |
 | `locadot update --host <name>.localhost --port/--target …` | Change the destination of an existing domain. |
 | `locadot remove --host <name>.localhost` (`rm`) | Remove a domain. |
+| `locadot allow --host <name>.localhost [addresses…] [--rm] [--clear]` | Let people on a tunnel or remote access reach internal addresses (`localhost:3000`) through a `--cors` domain. With no addresses, shows the list. Also `add … --allow a,b`. |
 | `locadot list` (`ls`, `host`) `[--json]` | Show all mappings. |
 | `locadot clear:hosts` | Remove all mappings. |
 | `locadot open [host]` | Open a domain, or the dashboard when no host is given, in your browser. |
@@ -94,7 +96,8 @@ Options for `add` / `update`:
 | Command | What it does |
 | --- | --- |
 | `locadot tunnel --host app.localhost` | Share a mapping on a public `https://<random>.trycloudflare.com` URL through a Cloudflare quick tunnel. No Cloudflare account is needed. `cloudflared` is downloaded on first use. |
-| `locadot tunnel --host app.localhost --off` | Stop sharing it. |
+| `locadot tunnel --host app.localhost --domain app.example.com` | Share it on your own hostname instead, on a domain in your Cloudflare account. The first time, `cloudflared` asks you to log in (the link is printed, and shown on the row in the dashboard). locadot creates a named tunnel for the mapping (`locadot-app-localhost`), points the hostname's DNS at it (replacing an existing record) and runs it. The URL stays the same across restarts. |
+| `locadot tunnel --host app.localhost --off` | Stop sharing it. The custom hostname is remembered for the dashboard; sharing again without `--domain` uses a random URL. |
 | `locadot tunnel` | List the shared mappings and their public URLs. |
 | `locadot tunnel:install` | Download `cloudflared` into the state dir (`<state>/bin`). Set `LOCADOT_CLOUDFLARED` to use your own binary; one on `PATH` is also picked up. |
 
@@ -106,6 +109,17 @@ pass-through calls may only go to public addresses: loopback, LAN, link-local an
 on the address actually dialled, so the tunnel can't be used to reach your machine or network. The dashboard can also do this:
 use **Share** / **Unshare** on a row.
 
+**Internal access.** If the shared frontend calls an internal API (`http://localhost:3000`), allow that address on the
+mapping, and tunnel visitors and connected machines (viewers included) can then reach it through the page:
+
+```sh
+locadot allow --host app.localhost localhost:3000      # add; `--rm` removes, `--clear` empties, no address lists
+```
+
+In the dashboard, click **Access** on the row. An entry is `host:port`, or a host alone for any of its ports. `127.0.0.1`
+and `0.0.0.0` count as `localhost`. Only the page's own requests can use it, and locadot's own ports stay blocked even
+when all of `localhost` is allowed. Allow only what the app needs: anyone who can open the mapping can reach these addresses.
+
 ### Remote access (locadot to locadot)
 
 One machine (the sender) publishes its whole locadot on a Cloudflare hostname. Other machines (receivers) connect with a
@@ -247,6 +261,8 @@ each time the proxy starts.
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
 | `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
 | `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
+| `PUT /api/hosts/:host` | `{ "allow": ["localhost:3000"] }` | Replace the internal addresses shared visitors may reach (normalized; `[]` clears; 400 if one is invalid). |
+| `PUT /api/hosts/:host` | `{ "tunnel": true, "domain": "app.example.com" }` | Share on a public URL: with `domain`, on that hostname through a named Cloudflare tunnel, without it on a random trycloudflare.com URL. `{ "tunnel": false }` stops sharing (400 for a bad hostname, 409 if another mapping uses it). |
 | `DELETE /api/hosts/:host` | | Remove a mapping. |
 | `POST /api/startup` | `{ "enabled": true }` | Start at boot on/off. |
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |

package/dist/cli/commands/hosts.js

@@ -38,12 +38,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.add = add;
 exports.update = update;
+exports.allow = allow;
 exports.remove = remove;
 exports.list = list;
 exports.clearHosts = clearHosts;
 const localhost_1 = __importStar(require("../../lib/localhost"));
 const registry_1 = __importDefault(require("../../lib/registry"));
 const hosts_1 = __importDefault(require("../../lib/hosts"));
+const allow_1 = require("../../lib/allow");
 const urls_1 = require("../../lib/urls");
 const shared_1 = require("../shared");
 const resolveTarget = (options) => {
@@ -61,6 +63,7 @@ const mapping = (options) => ({
     target: resolveTarget(options),
     insecure: options.insecure,
     cors: options.cors,
+    allow: options.allow,
 });
 const warnIfDown = async (entry) => {
     const probe = await localhost_1.default.probe(entry.target, 1500, entry.insecure);
@@ -82,6 +85,31 @@ async function update(options) {
     (0, shared_1.print)(`✅ Updated ${(0, urls_1.urlFor)(host)} → ${entry.target}`);
     await warnIfDown(entry);
 }
+async function allow(addresses, options) {
+    const host = localhost_1.default.requireHost(options.host);
+    const entry = registry_1.default.read().hosts[host];
+    if (!entry)
+        throw new localhost_1.InputError(`❌ ${host} isn't mapped. Add it first: locadot add --host ${host} --port <port> --cors`);
+    if (options.clear && addresses.length)
+        throw new localhost_1.InputError("❌ Use either --clear or addresses, not both.");
+    if (options.rm && !addresses.length)
+        throw new localhost_1.InputError("❌ Pass the addresses to remove.");
+    const current = entry.allow ?? [];
+    let next = current;
+    if (options.clear)
+        next = [];
+    else if (options.rm) {
+        const drop = new Set((0, allow_1.parseAllowList)(addresses));
+        next = current.filter((item) => !drop.has(item));
+    }
+    else if (addresses.length)
+        next = [...current, ...(0, allow_1.parseAllowList)(addresses)];
+    const { entry: saved } = next === current ? { entry } : await hosts_1.default.setAllow({ host, allow: next });
+    const list = saved.allow ?? [];
+    (0, shared_1.print)(list.length ? `🔓 ${(0, urls_1.urlFor)(host)} lets shared visitors reach: ${list.join(", ")}` : `🔒 ${(0, urls_1.urlFor)(host)} lets shared visitors reach public hosts only.`);
+    if (list.length && !saved.cors)
+        (0, shared_1.print)(`ℹ️  Takes effect once --cors is on: locadot update --host ${host} --target ${saved.target} --cors`);
+}
 async function remove(options) {
     const { host } = await hosts_1.default.remove(options);
     (0, shared_1.print)(`🗑️  Removed ${host}.`);
@@ -98,7 +126,7 @@ async function list(options) {
     }
     const width = Math.max(...hosts.map(([host]) => (0, urls_1.urlFor)(host).length));
     for (const [host, entry] of hosts) {
-        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}`);
+        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}`);
     }
     (0, shared_1.print)(`☑️ Total: ${hosts.length}.`);
 }

package/dist/cli/commands/tunnel.js

@@ -73,7 +73,7 @@ async function installTunnel() {
     const info = await (0, tunnel_1.installCloudflared)();
     (0, shared_1.print)(`✅ cloudflared ${info.version ?? ""} installed at ${info.path}`);
 }
-/** Shares a mapping on a public trycloudflare.com URL, or lists what's shared when no host is given. */
+/** Shares a mapping on a public trycloudflare.com URL or `--domain`, or lists what's shared when no host is given. */
 async function tunnel(options) {
     if (!options.host) {
         const shared = await tunnelRows();
@@ -91,11 +91,17 @@ async function tunnel(options) {
     }
     if (!(0, tunnel_1.cloudflaredInfo)(true).installed)
         await installTunnel();
-    await hosts_1.default.setTunnel({ host, tunnel: true });
+    await hosts_1.default.setTunnel({ host, tunnel: true, domain: options.domain });
     await (0, shared_1.ensureRunning)();
-    const deadline = Date.now() + TUNNEL_TIMEOUT_MS;
+    let deadline = Date.now() + TUNNEL_TIMEOUT_MS;
+    let loginShown = false;
     while (Date.now() < deadline) {
         const state = (await tunnelRows()).find((row) => row.host === host)?.tunnel;
+        if (state?.status === "login" && state.loginUrl && !loginShown) {
+            loginShown = true;
+            deadline = Date.now() + 10 * 60000;
+            (0, shared_1.print)(`🔑 Log in to Cloudflare to finish: ${state.loginUrl}`);
+        }
         if (state?.status === "up") {
             (0, shared_1.print)(`🌍 ${host} is public at ${state.url}`);
             (0, shared_1.print)("   Anyone with the link can reach it. Stop with: locadot tunnel --host " + host + " --off");

package/dist/dashboard/api.js

@@ -394,7 +394,13 @@ async function route(req, url, ctx) {
             return { status: 200, body: buildSettingsBody(ctx, warnings.length ? warnings.join("; ") : undefined) };
         }
         if (path === "/api/hosts") {
-            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
+            const { host, entry } = await hosts_1.default.add({
+                host: body.host,
+                target: body.target,
+                insecure: optionalBool(body.insecure, "insecure"),
+                cors: optionalBool(body.cors, "cors"),
+                allow: body.allow,
+            });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
             return { status: 201, body: { ok: true, host, ...entry, url: hostUrl(host, ctx) } };
@@ -409,13 +415,24 @@ async function route(req, url, ctx) {
             }
             const tunnel = optionalBool(body.tunnel, "tunnel");
             let updated;
-            if (body.target !== undefined || tunnel === undefined) {
-                updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
+            if (body.allow !== undefined && body.target === undefined) {
+                updated = await hosts_1.default.setAllow({ host, allow: body.allow });
+                logger_1.default.info(`✏️ dashboard: ${updated.host} allows ${updated.entry.allow?.join(", ") || "no internal addresses"}`);
+            }
+            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined)) {
+                updated = await hosts_1.default.update({
+                    host,
+                    target: body.target,
+                    insecure: optionalBool(body.insecure, "insecure"),
+                    cors: optionalBool(body.cors, "cors"),
+                    allow: body.allow,
+                });
                 logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             }
             if (tunnel !== undefined) {
-                updated = await hosts_1.default.setTunnel({ host, tunnel });
-                logger_1.default.info(`🌍 dashboard: ${tunnel ? "sharing" : "stopped sharing"} ${updated.host}`);
+                updated = await hosts_1.default.setTunnel({ host, tunnel, domain: body.domain });
+                const on = updated.entry.tunnelDomain && tunnel ? `sharing ${updated.host} on ${updated.entry.tunnelDomain}` : `sharing ${updated.host}`;
+                logger_1.default.info(`🌍 dashboard: ${tunnel ? on : `stopped sharing ${updated.host}`}`);
             }
             ctx.reload();
             if (tunnel)

package/dist/dashboard/index.js

@@ -91,6 +91,8 @@ async function buildHosts(ctx) {
             target: entry.target,
             insecure: !!entry.insecure,
             cors: !!entry.cors,
+            allow: entry.allow ?? [],
+            tunnelDomain: entry.tunnelDomain ?? null,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),