locadot 2.2.0 → 2.4.0

package/dist/index.js

@@ -44,8 +44,28 @@ program
     .description("HTTPS custom *.localhost domains for any local or remote upstream")
     .version(package_json_1.version)
     .helpOption("--help", "Display help for command");
-destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption())).action(run((options) => commands_1.default.add(options)));
+destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption()))
+    .option("--allow <addresses>", "Internal addresses shared visitors may reach through --cors, e.g. localhost:3000,localhost:4000")
+    .action(run((options) => commands_1.default.add(options)));
 destinationOptions(program.command("update").description("Change the destination of a mapped domain").addOption(hostOption())).action(run((options) => commands_1.default.update(options)));
+program
+    .command("allow [addresses...]")
+    .description("Let tunnel visitors and connected machines reach internal addresses (localhost:3000) through a --cors domain")
+    .addOption(hostOption())
+    .option("--rm", "Remove the given addresses instead of adding them")
+    .option("--clear", "Remove every allowed address")
+    .action(run((addresses, options) => commands_1.default.allow(addresses, options)));
+program
+    .command("protect")
+    .description("Ask for a password before a domain opens: on the shared link, for connected machines and/or on this machine")
+    .addOption(hostOption())
+    .option("--shared", "Ask visitors of the shared (tunnel) link")
+    .option("--remote", "Ask machines connected through remote access")
+    .option("--local", "Ask on this machine and your network")
+    .option("--password <password>", "The password (prompted for when left out)")
+    .option("--stdin", "Read the password from stdin")
+    .option("--off", "Stop asking for a password and forget it")
+    .action(run((options) => commands_1.default.protect(options)));
 program
     .command("remove")
     .alias("rm")
@@ -74,8 +94,9 @@ program
     .action(run((host) => commands_1.default.open(host)));
 program
     .command("tunnel")
-    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account); lists shared domains without --host")
+    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account) or on your own hostname; lists shared domains without --host")
     .option("-h, --host <host>", "Domain to share, e.g. app.localhost")
+    .option("-d, --domain <hostname>", "Share on this hostname in your Cloudflare account (named tunnel), e.g. app.example.com")
     .option("--off", "Stop sharing it")
     .action(run((options) => commands_1.default.tunnel(options)));
 program.command("tunnel:install").description("Download cloudflared into the locadot state dir").action(run(() => commands_1.default.installTunnel()));

package/dist/lib/allow.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowMatches = exports.splitHost = exports.parseAllowList = exports.parseAllow = exports.MAX_ALLOW = void 0;
+const net_1 = __importDefault(require("net"));
+const guard_1 = require("../proxy/guard");
+const localhost_1 = require("./localhost");
+/**
+ * A mapping's `allow` list: internal addresses (`localhost:3000`, `api.internal`) that a tunnel visitor or hub peer
+ * may reach through that mapping's --cors pass-through. Everyone else stays limited to public hosts.
+ */
+exports.MAX_ALLOW = 32;
+const LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+const HOSTNAME = new RegExp(`^${LABEL}(?:\\.${LABEL})*$`);
+/** Loopback spellings (127.0.0.1, 0.0.0.0) all mean this machine, and the shim sends whichever the app wrote. */
+const canonicalHost = (host) => ((0, guard_1.isLoopbackHost)(host) && !host.endsWith(".localhost") ? "localhost" : host);
+const parseAllow = (value) => {
+    if (typeof value !== "string")
+        throw new localhost_1.InputError("❌ Each allowed address must be a string, e.g. localhost:3000.");
+    const raw = value.trim().toLowerCase();
+    const bare = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/$/, "");
+    const match = bare.match(/^([^:/\s]+)(?::(\d{1,5}))?$/);
+    const port = match?.[2] === undefined ? undefined : Number(match[2]);
+    if (!match || !(net_1.default.isIPv4(match[1]) || HOSTNAME.test(match[1])) || (port !== undefined && (port < 1 || port > 65535))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a host or host:port, e.g. localhost:3000 or api.internal.`);
+    }
+    const host = canonicalHost(match[1]);
+    return port === undefined ? host : `${host}:${port}`;
+};
+exports.parseAllow = parseAllow;
+/** Normalizes and de-duplicates; an empty list clears it. */
+const parseAllowList = (value) => {
+    const items = typeof value === "string" ? value.split(",").filter((item) => item.trim()) : value;
+    if (!Array.isArray(items))
+        throw new localhost_1.InputError("❌ `allow` must be a list of addresses, e.g. [\"localhost:3000\"].");
+    const list = [...new Set(items.map(exports.parseAllow))];
+    if (list.length > exports.MAX_ALLOW)
+        throw new localhost_1.InputError(`❌ At most ${exports.MAX_ALLOW} allowed addresses per mapping.`);
+    return list;
+};
+exports.parseAllowList = parseAllowList;
+const defaultPort = (scheme) => (scheme === "https" || scheme === "wss" ? 443 : 80);
+/** `host` from the pass-through URL (no brackets: parseVia only accepts names and IPv4). */
+const splitHost = (host, scheme) => {
+    const match = host.toLowerCase().match(/^(.*?)(?::(\d+))?$/);
+    return { host: canonicalHost(match[1].replace(/\.$/, "")), port: match[2] ? Number(match[2]) : defaultPort(scheme) };
+};
+exports.splitHost = splitHost;
+const allowMatches = (allow, host, scheme) => {
+    if (!allow?.length)
+        return false;
+    const target = (0, exports.splitHost)(host, scheme);
+    return allow.some((entry) => {
+        const [name, port] = entry.split(":");
+        return name === target.host && (port === undefined || Number(port) === target.port);
+    });
+};
+exports.allowMatches = allowMatches;

package/dist/lib/host-auth.js

@@ -0,0 +1,123 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseScopes = exports.MIN_HOST_PASSWORD = exports.HOST_SESSION_TTL_SEC = exports.HOST_COOKIE = exports.SCOPES = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+exports.SCOPES = ["shared", "remote", "local"];
+exports.HOST_COOKIE = "locadot_pw";
+exports.HOST_SESSION_TTL_SEC = 7 * 24 * 3600;
+exports.MIN_HOST_PASSWORD = 8;
+const hashOf = (password, salt) => crypto_1.default.scryptSync(password, Buffer.from(salt, "base64"), 32).toString("base64");
+const sign = (secret, value) => crypto_1.default.createHmac("sha256", secret).update(value).digest("base64url");
+const safeEqual = (a, b) => {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
+};
+let cache;
+const readAll = () => {
+    let mtimeMs;
+    try {
+        mtimeMs = fs_1.default.statSync(constants_1.default.paths.HOST_PASSWORDS_FILE).mtimeMs;
+    }
+    catch {
+        cache = undefined;
+        return {};
+    }
+    if (!cache || cache.mtimeMs !== mtimeMs) {
+        let value = {};
+        try {
+            const data = JSON.parse(file_1.default.read("HOST_PASSWORDS_FILE") || "{}");
+            if (data && typeof data === "object")
+                value = data;
+        }
+        catch { }
+        cache = { mtimeMs, value };
+    }
+    return cache.value;
+};
+const writeAll = (all) => {
+    file_1.default.writeAtomic("HOST_PASSWORDS_FILE", JSON.stringify(all, null, 2));
+    fs_1.default.chmodSync(constants_1.default.paths.HOST_PASSWORDS_FILE, 0o600);
+    cache = undefined;
+};
+const failures = new Map();
+const FAIL_WINDOW_MS = 5 * 60000;
+const MAX_FAILURES = 10;
+const parseScopes = (value) => {
+    const list = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
+    const scopes = [...new Set(list.map((item) => String(item).trim().toLowerCase()).filter(Boolean))];
+    const bad = scopes.find((scope) => !exports.SCOPES.includes(scope));
+    if (bad)
+        throw new Error(`"${bad}" isn't a place to ask for the password; use shared, remote or local.`);
+    return exports.SCOPES.filter((scope) => scopes.includes(scope));
+};
+exports.parseScopes = parseScopes;
+class HostAuth {
+    static has(host) {
+        return Boolean(readAll()[host]);
+    }
+    static updatedAt(host) {
+        return readAll()[host]?.updatedAt;
+    }
+    static set(host, password) {
+        if (typeof password !== "string" || password.length < exports.MIN_HOST_PASSWORD) {
+            throw new Error(`The password must be at least ${exports.MIN_HOST_PASSWORD} characters.`);
+        }
+        const salt = crypto_1.default.randomBytes(16).toString("base64");
+        const entry = { salt, hash: hashOf(password, salt), secret: crypto_1.default.randomBytes(32).toString("base64"), updatedAt: new Date().toISOString() };
+        writeAll({ ...readAll(), [host]: entry });
+    }
+    static clear(host) {
+        const all = { ...readAll() };
+        if (!all[host])
+            return;
+        delete all[host];
+        writeAll(all);
+    }
+    static verify(host, password) {
+        const data = readAll()[host];
+        if (!data || typeof password !== "string" || !password)
+            return false;
+        return safeEqual(hashOf(password, data.salt), data.hash);
+    }
+    /** `<expiry>.<mac>`, bound to the host; nothing is kept server-side. */
+    static issue(host, now = Date.now()) {
+        const data = readAll()[host];
+        if (!data)
+            throw new Error(`${host} has no password.`);
+        const exp = String(Math.floor(now / 1000) + exports.HOST_SESSION_TTL_SEC);
+        return `${exp}.${sign(data.secret, `${host}|${exp}`)}`;
+    }
+    static validSession(host, value, now = Date.now()) {
+        const data = readAll()[host];
+        if (!data || !value)
+            return false;
+        const [exp, mac] = value.split(".");
+        if (!/^\d+$/.test(exp || "") || !mac || Number(exp) * 1000 < now)
+            return false;
+        return safeEqual(mac, sign(data.secret, `${host}|${exp}`));
+    }
+    static limited(key, now = Date.now()) {
+        const entry = failures.get(key);
+        if (!entry || now - entry.since > FAIL_WINDOW_MS)
+            return false;
+        return entry.count >= MAX_FAILURES;
+    }
+    static fail(key, now = Date.now()) {
+        const entry = failures.get(key);
+        if (!entry || now - entry.since > FAIL_WINDOW_MS)
+            failures.set(key, { count: 1, since: now });
+        else
+            entry.count++;
+    }
+    static succeed(key) {
+        failures.delete(key);
+    }
+}
+exports.default = HostAuth;

package/dist/lib/hosts.js

@@ -36,10 +36,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConflictError = exports.NotFoundError = void 0;
+exports.parseTunnelDomain = exports.ConflictError = exports.NotFoundError = void 0;
 const constants_1 = __importDefault(require("../constants"));
 const localhost_1 = __importStar(require("./localhost"));
 const registry_1 = __importDefault(require("./registry"));
+const allow_1 = require("./allow");
+const hub_config_1 = __importDefault(require("./hub-config"));
+const host_auth_1 = __importStar(require("./host-auth"));
 class NotFoundError extends localhost_1.InputError {
 }
 exports.NotFoundError = NotFoundError;
@@ -53,17 +56,30 @@ const requireTarget = (value) => {
     }
     return localhost_1.default.parseTarget(String(value));
 };
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A public hostname on the user's Cloudflare zone, e.g. app.example.com (scheme and trailing slash allowed). */
+const parseTunnelDomain = (value) => {
+    const domain = typeof value === "string" ? value.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/$/, "") : "";
+    const labels = domain.split(".");
+    const tld = labels[labels.length - 1];
+    if (domain.length > 253 || labels.length < 2 || tld === "localhost" || !/[a-z]/.test(tld) || !labels.every((label) => LABEL.test(label))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a public hostname, e.g. app.example.com.`);
+    }
+    return domain;
+};
+exports.parseTunnelDomain = parseTunnelDomain;
 class HostOps {
     static async add(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? [] : (0, allow_1.parseAllowList)(input.allow);
         const now = new Date().toISOString();
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -71,24 +87,108 @@ class HostOps {
     static async update(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? undefined : (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             const insecure = input.insecure ?? existing.insecure;
             const cors = input.cors ?? existing.cors;
-            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, cors: cors || undefined, updatedAt: new Date().toISOString() };
+            const list = allow ?? existing.allow;
+            registry.hosts[host] = {
+                ...existing,
+                target,
+                insecure: insecure || undefined,
+                cors: cors || undefined,
+                allow: list?.length ? list : undefined,
+                updatedAt: new Date().toISOString(),
+            };
             return registry.hosts[host];
         });
         return { host, entry };
     }
+    /** Sharing on: `domain` shares on that hostname, none on a random trycloudflare.com URL. Sharing off keeps the hostname for next time. */
     static async setTunnel(input) {
         const host = localhost_1.default.requireHost(input.host);
+        const domain = input.tunnel && input.domain !== undefined && input.domain !== null && input.domain !== "" ? (0, exports.parseTunnelDomain)(input.domain) : undefined;
+        if (domain && hub_config_1.default.read()?.domain === domain)
+            throw new ConflictError(`❌ ${domain} is this machine's remote-access hostname.`);
+        const entry = await registry_1.default.mutate((registry) => {
+            const existing = registry.hosts[host];
+            if (!existing)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            if (domain && existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; share it on a custom hostname from that machine.`);
+            const taken = domain && Object.entries(registry.hosts).find(([other, e]) => other !== host && e.tunnelDomain === domain)?.[0];
+            if (taken)
+                throw new ConflictError(`❌ ${domain} is already the shared hostname of ${taken}.`);
+            const tunnelDomain = input.tunnel ? domain : existing.tunnelDomain;
+            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, tunnelDomain, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
+    static async setAllow(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const allow = (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
-            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, updatedAt: new Date().toISOString() };
+            if (existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; set its allowed addresses on that machine.`);
+            registry.hosts[host] = { ...existing, allow: allow.length ? allow : undefined, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
+    /**
+     * Password protection: `scopes` picks where it's asked for (at least one). `password` is needed the first time;
+     * leaving it out keeps the current one. `off` removes the protection and the password.
+     */
+    static async setProtect(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const existing = registry_1.default.read().hosts[host];
+        if (!existing)
+            throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+        if (existing.remote)
+            throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; protect it on that machine.`);
+        if (input.off) {
+            const entry = await registry_1.default.mutate((registry) => {
+                const current = registry.hosts[host];
+                if (!current)
+                    throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+                registry.hosts[host] = { ...current, protect: undefined, updatedAt: new Date().toISOString() };
+                return registry.hosts[host];
+            });
+            host_auth_1.default.clear(host);
+            return { host, entry };
+        }
+        let scopes;
+        try {
+            scopes = (0, host_auth_1.parseScopes)(input.scopes);
+        }
+        catch (error) {
+            throw new localhost_1.InputError(`❌ ${error.message}`);
+        }
+        if (!scopes.length)
+            throw new localhost_1.InputError("❌ Pick at least one place to ask for the password: shared, remote or local.");
+        const password = input.password === undefined || input.password === null || input.password === "" ? undefined : input.password;
+        if (password === undefined && !host_auth_1.default.has(host))
+            throw new localhost_1.InputError(`❌ Set a password to protect ${host}.`);
+        if (password !== undefined) {
+            try {
+                host_auth_1.default.set(host, String(password));
+            }
+            catch (error) {
+                throw new localhost_1.InputError(`❌ ${error.message}`);
+            }
+        }
+        const entry = await registry_1.default.mutate((registry) => {
+            const current = registry.hosts[host];
+            if (!current)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            registry.hosts[host] = { ...current, protect: { scopes }, updatedAt: new Date().toISOString() };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -100,6 +200,7 @@ class HostOps {
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             delete registry.hosts[host];
         });
+        host_auth_1.default.clear(host);
         return { host };
     }
 }

package/dist/proxy/cloudflare-logins.js

@@ -0,0 +1,197 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCapture = exports.loggedInZones = exports.covers = void 0;
+exports.setupDomainTunnel = setupDomainTunnel;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const constants_1 = __importDefault(require("../constants"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const tunnel_1 = require("./tunnel");
+/**
+ * Cloudflare logins for custom-domain sharing. `cloudflared tunnel login` authorizes a single zone,
+ * so each login is kept as <state>/cloudflare/<zone>.pem and the one whose zone covers a hostname
+ * is used; ~/.cloudflared/cert.pem counts as one but is never written. A cert's zone is looked up
+ * with the API token inside it.
+ */
+const DIR = path_1.default.join(constants_1.default.paths.HOME, "cloudflare");
+const ZONES_FILE = path_1.default.join(DIR, "zones.json");
+const LOGIN_WAIT_MS = 10 * 60000;
+const API = () => process.env.LOCADOT_CLOUDFLARE_API || "https://api.cloudflare.com/client/v4";
+const defaultCert = () => path_1.default.join(os_1.default.homedir(), ".cloudflared", "cert.pem");
+const readToken = (file) => {
+    try {
+        const body = fs_1.default.readFileSync(file, "utf8").match(/-----BEGIN ARGO TUNNEL TOKEN-----([\s\S]*?)-----END/)?.[1];
+        const token = body && JSON.parse(Buffer.from(body.replace(/\s/g, ""), "base64").toString("utf8"));
+        return token?.zoneID ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** zoneID → zone name, learned from the API or from where cloudflared put a DNS record. */
+const readZones = () => {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(ZONES_FILE, "utf8"));
+    }
+    catch {
+        return {};
+    }
+};
+const rememberZone = (zoneID, zone) => {
+    fs_1.default.mkdirSync(DIR, { recursive: true });
+    fs_1.default.writeFileSync(ZONES_FILE, JSON.stringify({ ...readZones(), [zoneID]: zone }, null, 2));
+};
+const certFiles = () => {
+    const stored = fs_1.default.existsSync(DIR) ? fs_1.default.readdirSync(DIR).filter((f) => f.endsWith(".pem")).map((f) => path_1.default.join(DIR, f)) : [];
+    return [defaultCert(), ...stored].filter((file) => fs_1.default.existsSync(file));
+};
+const covers = (zone, hostname) => hostname === zone || hostname.endsWith(`.${zone}`);
+exports.covers = covers;
+/** Zones there's a login for, as far as they're known (no network). */
+const loggedInZones = () => {
+    const zones = readZones();
+    return [...new Set(certFiles().map((file) => zones[readToken(file)?.zoneID || ""]).filter(Boolean))].sort();
+};
+exports.loggedInZones = loggedInZones;
+const zoneOf = async (file) => {
+    const token = readToken(file);
+    if (!token)
+        return undefined;
+    const known = readZones()[token.zoneID];
+    if (known)
+        return known;
+    try {
+        const res = await fetch(`${API()}/zones/${token.zoneID}`, {
+            headers: { Authorization: `Bearer ${token.apiToken}` },
+            signal: AbortSignal.timeout(10000),
+        });
+        const name = (await res.json())?.result?.name;
+        if (res.ok && typeof name === "string") {
+            rememberZone(token.zoneID, name);
+            return name;
+        }
+        logger_1.default.warn(`🌍 couldn't look up the zone of a Cloudflare login: HTTP ${res.status}`);
+    }
+    catch (error) {
+        logger_1.default.warn(`🌍 couldn't look up the zone of a Cloudflare login: ${error?.cause?.message || error?.message || error}`);
+    }
+    return undefined;
+};
+const runCapture = (file, args, opts = {}) => new Promise((resolve, reject) => {
+    const child = (0, child_process_1.spawn)(file, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true, env: opts.env, signal: opts.signal });
+    let output = "";
+    let done = false;
+    const finish = (fn) => {
+        if (done)
+            return;
+        done = true;
+        if (timer)
+            clearTimeout(timer);
+        fn();
+    };
+    const timer = opts.timeoutMs
+        ? setTimeout(() => finish(() => (child.kill(), reject(new Error(`${args.join(" ")} timed out`)))), opts.timeoutMs)
+        : undefined;
+    const read = (chunk) => {
+        const text = chunk.toString("utf8");
+        output += text;
+        opts.onData?.(text);
+    };
+    child.stdout?.on("data", read);
+    child.stderr?.on("data", read);
+    child.on("error", (error) => finish(() => reject(error)));
+    child.on("exit", (code) => finish(() => resolve({ code, output })));
+});
+exports.runCapture = runCapture;
+/** Runs `cloudflared tunnel login` against a scratch home so the new cert never replaces an existing one. */
+const signIn = async (file, onLoginUrl, signal) => {
+    const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "locadot-cf-login-"));
+    try {
+        let announced = false;
+        const login = await (0, exports.runCapture)(file, ["tunnel", "login"], {
+            timeoutMs: LOGIN_WAIT_MS,
+            signal,
+            env: { ...process.env, HOME: home, USERPROFILE: home },
+            onData: (text) => {
+                const url = !announced && text.match(/https:\/\/\S+/)?.[0];
+                if (url) {
+                    announced = true;
+                    onLoginUrl(url);
+                }
+            },
+        }).catch((error) => {
+            throw new Error(/timed out/.test(error.message) ? "The Cloudflare sign-in wasn't finished within 10 minutes." : error.message);
+        });
+        const cert = path_1.default.join(home, ".cloudflared", "cert.pem");
+        const token = readToken(cert);
+        if (login.code !== 0 || !token)
+            throw new Error(`Cloudflare sign-in failed: ${login.output.trim().slice(-300) || `cloudflared exited (${login.code})`}`);
+        fs_1.default.mkdirSync(DIR, { recursive: true });
+        const staged = path_1.default.join(DIR, `${token.zoneID}.pem`);
+        fs_1.default.copyFileSync(cert, staged);
+        fs_1.default.chmodSync(staged, 0o600);
+        const zone = await zoneOf(staged);
+        if (!zone)
+            return staged;
+        const named = path_1.default.join(DIR, `${zone}.pem`);
+        fs_1.default.renameSync(staged, named);
+        return named;
+    }
+    finally {
+        fs_1.default.rmSync(home, { recursive: true, force: true });
+    }
+};
+const notAuthorized = (domain, zone) => new Error(`Your Cloudflare sign-in authorized ${zone}, which doesn't include ${domain}. Share again and pick the zone ${domain} belongs to, or add that domain to your Cloudflare account first.`);
+/**
+ * Makes `name` a named tunnel serving `domain`: uses the login whose zone covers it, or signs in
+ * (reporting the URL through onLoginUrl), creates the tunnel and routes the DNS record.
+ * Throws a readable error when no login covers the domain.
+ */
+async function setupDomainTunnel(domain, name, onLoginUrl, signal) {
+    const file = (0, tunnel_1.cloudflaredPath)();
+    if (!file)
+        throw new Error("cloudflared is not installed. Run `locadot tunnel:install`.");
+    let cert;
+    const unknown = [];
+    for (const candidate of certFiles()) {
+        const zone = await zoneOf(candidate);
+        if (zone && (0, exports.covers)(zone, domain)) {
+            cert = candidate;
+            break;
+        }
+        if (!zone)
+            unknown.push(candidate);
+    }
+    // A login whose zone couldn't be looked up is tried; route dns shows which zone it's for.
+    cert || (cert = unknown[0]);
+    if (!cert) {
+        cert = await signIn(file, onLoginUrl, signal);
+        const zone = await zoneOf(cert);
+        if (zone && !(0, exports.covers)(zone, domain))
+            throw notAuthorized(domain, zone);
+    }
+    const token = readToken(cert);
+    const credentials = path_1.default.join(DIR, "tunnels", token.accountID, `${name}.json`);
+    fs_1.default.mkdirSync(path_1.default.dirname(credentials), { recursive: true });
+    const create = await (0, exports.runCapture)(file, ["tunnel", "--origincert", cert, "create", "--credentials-file", credentials, name], { signal });
+    if (create.code !== 0 && !/already exists/i.test(create.output)) {
+        throw new Error(`cloudflared tunnel create failed: ${create.output.trim().slice(-500)}`);
+    }
+    const route = await (0, exports.runCapture)(file, ["tunnel", "--origincert", cert, "route", "dns", "--overwrite-dns", name, domain], { signal });
+    if (route.code !== 0)
+        throw new Error(`cloudflared tunnel route dns failed: ${route.output.trim().slice(-500)}`);
+    // Outside the login's zone, cloudflared appends the zone and "succeeds" with <domain>.<zone>.
+    const routed = route.output.match(/Added CNAME (\S+)/i)?.[1] || route.output.match(/(\S+) is already configured to route/i)?.[1];
+    if (routed && routed.toLowerCase().replace(/\.$/, "") !== domain) {
+        const zone = routed.toLowerCase().startsWith(`${domain}.`) ? routed.slice(domain.length + 1) : undefined;
+        if (zone)
+            rememberZone(token.zoneID, zone);
+        throw new Error(`${domain} isn't in the Cloudflare zone this login is for${zone ? ` (${zone})` : ""}; cloudflared created ${routed} instead. Delete that record in Cloudflare, then share again to sign in for ${domain}'s zone.`);
+    }
+    return { cert, credentials: fs_1.default.existsSync(credentials) ? credentials : undefined };
+}

package/dist/proxy/guard.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
+exports.notSelfAgents = exports.isSelfAddress = exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
 const dns_1 = __importDefault(require("dns"));
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
+const os_1 = __importDefault(require("os"));
 /**
  * Tunnel visitors are the internet. Their --cors pass-through calls may only leave this machine
  * for public addresses, never loopback, the LAN or cloud metadata.
@@ -93,3 +94,31 @@ exports.publicOnlyAgents = {
     http: new http_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
     https: new https_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
 };
+/** Loopback or one of this machine's own interface addresses (its LAN IP reaches the proxy just as well). */
+const isSelfAddress = (address) => {
+    if ((0, exports.isLoopbackHost)(address))
+        return true;
+    const own = Object.values(os_1.default.networkInterfaces()).flatMap((list) => (list || []).map((item) => item.address.toLowerCase()));
+    return own.includes(address.replace(/^\[|\]$/g, "").toLowerCase());
+};
+exports.isSelfAddress = isSelfAddress;
+// For an allowed address on the proxy's own port: whatever the name resolves to, it must not be this machine.
+const notSelfLookup = (hostname, options, callback) => {
+    dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err)
+            return callback(err, "", 0);
+        const allowed = addresses.filter((entry) => !(0, exports.isSelfAddress)(entry.address));
+        if (!allowed.length) {
+            const error = new Error(`${hostname} is this machine`);
+            error.code = "ESELF";
+            return callback(error, "", 0);
+        }
+        if (options.all)
+            return callback(null, allowed);
+        callback(null, allowed[0].address, allowed[0].family);
+    });
+};
+exports.notSelfAgents = {
+    http: new http_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+    https: new https_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+};

package/dist/proxy/options.js

@@ -22,14 +22,22 @@ const proxyOptions = (req, entry, lookup) => ({
     headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? { ...(0, cors_1.sameOriginHeaders)(req, entry, lookup), ...DECODABLE } : {}) },
 });
 exports.proxyOptions = proxyOptions;
-const viaOptions = (req, entry, via) => ({
+const agentFor = (req, via, listed) => {
+    const tls = via.scheme === "https" || via.scheme === "wss";
+    if (listed === "not-self")
+        return { agent: tls ? guard_1.notSelfAgents.https : guard_1.notSelfAgents.http };
+    if ((0, request_1.fromTunnel)(req) && !listed)
+        return { agent: tls ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http };
+    return {};
+};
+const viaOptions = (req, entry, via, listed) => ({
     target: (0, exports.viaOrigin)(via),
     changeOrigin: true,
     ws: true,
     secure: !entry.insecure,
     cookieDomainRewrite: { "*": "" },
     headers: { ...(0, passthrough_1.viaHeaders)(req, via, entry.target), ...DECODABLE },
-    ...((0, request_1.fromTunnel)(req) ? { agent: via.scheme === "https" || via.scheme === "wss" ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http } : {}),
+    ...agentFor(req, via, listed),
 });
 exports.viaOptions = viaOptions;
 const viaOrigin = (via) => `${via.scheme}://${via.host}`;