locadot 2.2.0 → 2.4.0

package/dist/proxy/protect.js

@@ -0,0 +1,215 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopeOf = exports.LOGIN_PATH = void 0;
+exports.guard = guard;
+exports.guardUpgrade = guardUpgrade;
+const crypto_1 = __importDefault(require("crypto"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const escape_1 = require("../dashboard/escape");
+const host_auth_1 = __importStar(require("../lib/host-auth"));
+const ui_auth_1 = require("../lib/ui-auth");
+const passthrough_1 = require("./passthrough");
+const request_1 = require("./request");
+const hub_1 = require("./hub");
+/**
+ * Password protection for a mapping (`protect`), on the paths in it was picked for. Visitors get a sign-in page and,
+ * with the password, a cookie signed for that host; the cookie is taken off before the request goes upstream.
+ */
+exports.LOGIN_PATH = `${passthrough_1.PREFIX}login`;
+const MAX_BODY = 4096;
+const scopeOf = (req) => ((0, request_1.fromTunnel)(req) ? "shared" : (0, request_1.fromRemote)(req) ? "remote" : "local");
+exports.scopeOf = scopeOf;
+const protectedHere = (req, entry) => Boolean(entry.protect?.scopes.includes((0, exports.scopeOf)(req)));
+const signedIn = (req, host) => host_auth_1.default.validSession(host, (0, ui_auth_1.cookieOf)(req.headers.cookie, host_auth_1.HOST_COOKIE));
+const stripCookie = (req) => {
+    const header = req.headers.cookie;
+    if (!header)
+        return;
+    const rest = header.split(";").filter((part) => part.split("=")[0].trim() !== host_auth_1.HOST_COOKIE).join(";").trim();
+    if (rest)
+        req.headers.cookie = rest;
+    else
+        delete req.headers.cookie;
+};
+// Visitors on a tunnel or remote access all arrive from cloudflared, so count their failures by their own IP.
+const limitKey = (req, host) => `${host}|${(0, exports.scopeOf)(req) === "local" ? req.socket.remoteAddress || "" : (0, hub_1.clientIp)(req)}`;
+/** A path on this site to go back to after signing in; anything else goes to /. */
+const safeNext = (value) => (typeof value === "string" && /^\/(?![/\\])/.test(value) ? value : "/");
+const shownHost = (req) => (req.headers.host || "").replace(/:\d+$/, "") || "this site";
+const page = (nonce, host, next, error) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="dark light">
+<meta name="robots" content="noindex">
+<title>Password required · ${(0, escape_1.escapeHtml)(host)}</title>
+<style nonce="${nonce}">
+:root { --bg: #f6f7f9; --surface: #fff; --border: #e3e6eb; --fg: #111827; --muted: #6b7280; --accent: #2563eb; --accent-bg: #eff4ff; --down: #dc2626; --down-bg: #fef2f2; }
+@media (prefers-color-scheme: dark) { :root { --bg: #0d1117; --surface: #161b22; --border: #30363d; --fg: #e6edf3; --muted: #8b949e; --accent: #3b82f6; --accent-bg: #172554; --down: #f87171; --down-bg: #2a1215; } }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 16px; background: var(--bg); color: var(--fg); font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+form { width: 100%; max-width: 360px; background: var(--surface); border: 1px solid var(--border); border-radius: 14px; padding: 32px 28px 24px; display: flex; flex-direction: column; gap: 16px; box-shadow: 0 10px 30px rgba(0, 0, 0, 0.06); }
+.icon { width: 44px; height: 44px; border-radius: 12px; display: grid; place-items: center; background: var(--accent-bg); color: var(--accent); }
+.icon svg { width: 22px; height: 22px; fill: none; stroke: currentColor; stroke-width: 2; stroke-linecap: round; stroke-linejoin: round; }
+h1 { margin: 0; font-size: 18px; }
+p { margin: 0; color: var(--muted); }
+.host { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--fg); overflow-wrap: anywhere; }
+label { display: block; font-weight: 600; font-size: 13px; margin-bottom: 6px; }
+input { width: 100%; padding: 10px 12px; border-radius: 8px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font: inherit; }
+input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-bg); }
+button { padding: 10px; border: 0; border-radius: 8px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; cursor: pointer; }
+button:hover { filter: brightness(1.05); }
+.error { color: var(--down); background: var(--down-bg); border-radius: 8px; padding: 8px 10px; font-size: 13px; }
+.foot { font-size: 12px; text-align: center; }
+.sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
+</style>
+</head>
+<body>
+<form method="post" action="${exports.LOGIN_PATH}">
+  <div class="icon" aria-hidden="true"><svg viewBox="0 0 24 24"><rect x="5" y="11" width="14" height="10" rx="2"/><path d="M8 11V8a4 4 0 0 1 8 0v3"/></svg></div>
+  <div>
+    <h1>Password required</h1>
+    <p><span class="host">${(0, escape_1.escapeHtml)(host)}</span> is protected. Enter the password to continue.</p>
+  </div>
+  <input type="hidden" name="next" value="${(0, escape_1.escapeHtml)(next)}">
+  <input class="sr" type="text" name="username" value="${(0, escape_1.escapeHtml)(host)}" autocomplete="username" tabindex="-1" aria-hidden="true" readonly>
+  <div><label for="password">Password</label>
+  <input id="password" name="password" type="password" autocomplete="current-password" required autofocus></div>
+  ${error ? `<div class="error" role="alert">${(0, escape_1.escapeHtml)(error)}</div>` : ""}
+  <button type="submit">Continue</button>
+  <p class="foot">Protected by locadot</p>
+</form>
+</body>
+</html>
+`;
+const sendPage = (req, res, status, next, error) => {
+    const nonce = crypto_1.default.randomBytes(16).toString("base64");
+    res.writeHead(status, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
+        "X-Robots-Tag": "noindex",
+    });
+    res.end(req.method === "HEAD" ? undefined : page(nonce, shownHost(req), next, error));
+};
+const readForm = (req) => new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size <= MAX_BODY)
+            chunks.push(chunk);
+    });
+    req.on("error", reject);
+    req.on("end", () => resolve(new URLSearchParams(size > MAX_BODY ? "" : Buffer.concat(chunks).toString("utf8"))));
+});
+// Tunnel visitors are on https even though cloudflared talks plain http to us.
+const cookie = (req, value) => `${host_auth_1.HOST_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${host_auth_1.HOST_SESSION_TTL_SEC}${(0, request_1.isTls)(req) || (0, request_1.fromTunnel)(req) ? "; Secure" : ""}`;
+function login(req, res, host, url) {
+    if (req.method === "GET" || req.method === "HEAD") {
+        sendPage(req, res, 200, safeNext(url.searchParams.get("next")));
+        return;
+    }
+    if (req.method !== "POST") {
+        res.writeHead(405, { Allow: "GET, POST" });
+        res.end();
+        return;
+    }
+    const site = req.headers["sec-fetch-site"];
+    if (site && site !== "same-origin" && site !== "none") {
+        sendPage(req, res, 403, "/", "Sign in from this site's own page.");
+        return;
+    }
+    const key = limitKey(req, host);
+    if (host_auth_1.default.limited(key)) {
+        sendPage(req, res, 429, "/", "Too many wrong passwords. Wait a few minutes and try again.");
+        return;
+    }
+    readForm(req)
+        .then((form) => {
+        const next = safeNext(form.get("next"));
+        if (!host_auth_1.default.verify(host, form.get("password"))) {
+            host_auth_1.default.fail(key);
+            logger_1.default.warn(`🔒 ${host}: wrong password from ${key.split("|")[1]}`);
+            return sendPage(req, res, 401, next, "Wrong password.");
+        }
+        host_auth_1.default.succeed(key);
+        res.writeHead(303, { Location: next, "Set-Cookie": cookie(req, host_auth_1.default.issue(host)), "Cache-Control": "no-store" });
+        res.end();
+    })
+        .catch(() => sendPage(req, res, 400, "/", "Couldn't read the form."));
+}
+/** Answers the request itself (sign-in page, 401) unless it may go through; returns whether it did. */
+function guard(req, res, host, entry) {
+    if (!protectedHere(req, entry))
+        return false;
+    const url = new URL(req.url || "/", "http://host.invalid");
+    if (!host_auth_1.default.has(host)) {
+        res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+        res.end(`locadot: ${host} is password protected but has no password set. Set one: locadot protect --host ${host}\n`);
+        return true;
+    }
+    if (url.pathname === exports.LOGIN_PATH) {
+        login(req, res, host, url);
+        return true;
+    }
+    if (signedIn(req, host)) {
+        stripCookie(req);
+        return false;
+    }
+    const html = (req.method === "GET" || req.method === "HEAD") && /text\/html|\*\/\*/.test(String(req.headers.accept || ""));
+    if (html) {
+        sendPage(req, res, 401, safeNext(req.url));
+        return true;
+    }
+    res.writeHead(401, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(`locadot: ${shownHost(req)} is password protected. Open it in a browser to sign in.\n`);
+    return true;
+}
+function guardUpgrade(req, socket, host, entry) {
+    if (!protectedHere(req, entry))
+        return false;
+    if (host_auth_1.default.has(host) && signedIn(req, host)) {
+        stripCookie(req);
+        return false;
+    }
+    socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+    return true;
+}

package/dist/proxy/router.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRequest = handleRequest;
 exports.handleUpgrade = handleUpgrade;
 const http_1 = __importDefault(require("http"));
+const net_1 = __importDefault(require("net"));
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
@@ -14,9 +15,11 @@ const remote_1 = require("./remote");
 const cors_1 = require("./cors");
 const options_1 = require("./options");
 const guard_1 = require("./guard");
+const allow_1 = require("../lib/allow");
 const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
+const protect_1 = require("./protect");
 // Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
 const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
@@ -55,8 +58,23 @@ const peerMayReach = (req, via) => {
     const port = Number(via.host.match(/:(\d+)$/)?.[1] || (via.scheme === "https" || via.scheme === "wss" ? 443 : 80));
     return Boolean(allowed && !allowed.includes(port));
 };
-/** Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost. */
-const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via);
+/**
+ * An address on the mapping's `allow` list. The proxy's own ports on this machine never are (the dashboard is behind
+ * them): "not-self" means the name must be checked at connect time, on the address actually dialled.
+ */
+const listed = (req, ctx, entry, via) => {
+    if (!((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req)) || !(0, allow_1.allowMatches)(entry.allow, via.host, via.scheme))
+        return undefined;
+    const { host, port } = (0, allow_1.splitHost)(via.host, via.scheme);
+    if (!(ctx.ownPorts?.() ?? []).includes(port))
+        return "open";
+    return (0, guard_1.isSelfAddress)(host) ? undefined : net_1.default.isIP(host) ? "open" : "not-self";
+};
+/**
+ * Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost,
+ * unless the mapping's owner listed the address in `allow`.
+ */
+const viaAllowed = (req, via, allowed) => (0, passthrough_1.isSameOrigin)(req) && (Boolean(allowed) || ((!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via)));
 /**
  * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
  * its apps' origins to the names this machine uses rather than its own.
@@ -135,10 +153,14 @@ function handleRequest(req, res, ctx) {
             res.end(passthrough_1.shimScript);
             return;
         }
+        if ((0, protect_1.guard)(req, res, host, entry))
+            return;
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-            res.end("locadot: the pass-through only serves the page's own requests, and only public hosts through a tunnel.\n");
+            res.end(`locadot: the pass-through only serves the page's own requests, and only public hosts to shared visitors. ` +
+                `To let them reach ${via.host}, run \`locadot allow --host ${host} ${via.host}\` on this machine, or use Internal access on the mapping in the dashboard.\n`);
             return;
         }
         const started = Date.now();
@@ -148,7 +170,7 @@ function handleRequest(req, res, ctx) {
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
             (0, request_1.tag)(req, { via });
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         const upstream = via ? (0, options_1.viaOrigin)(via) : entry.target;
@@ -251,15 +273,18 @@ function handleUpgrade(req, socket, head, ctx) {
             });
             return;
         }
+        if ((0, protect_1.guardUpgrade)(req, socket, host, entry))
+            return;
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
             return;
         }
         logger_1.default.debug(`WebSocket upgrade for ${host}`);
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         ctx.proxy.ws(req, socket, head, options, (err) => {

package/dist/proxy/tunnel.js

@@ -11,8 +11,10 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
+const cloudflare_logins_1 = require("./cloudflare-logins");
 /**
- * Public sharing through Cloudflare quick tunnels (https://<random>.trycloudflare.com, no account).
+ * Public sharing through Cloudflare quick tunnels (https://<random>.trycloudflare.com, no account),
+ * or through a named tunnel per mapping on the user's own hostname (`tunnelDomain`).
  * cloudflared forwards to the proxy's HTTP port with the public Host header, and the proxy maps
  * that name back to the mapping, so redirects and cookies stay on the public name.
  */
@@ -20,6 +22,7 @@ const exe = os_1.default.platform() === "win32" ? "cloudflared.exe" : "cloudflar
 const BIN_DIR = path_1.default.join(constants_1.default.paths.HOME, "bin");
 const RELEASES = "https://github.com/cloudflare/cloudflared/releases/latest/download/";
 const URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+const REGISTERED_PATTERN = /Registered tunnel connection/i;
 const onPath = () => {
     const finder = os_1.default.platform() === "win32" ? "where" : "which";
     const result = (0, child_process_1.spawnSync)(finder, ["cloudflared"], { encoding: "utf8", windowsHide: true });
@@ -34,14 +37,17 @@ exports.cloudflaredPath = cloudflaredPath;
 // The dashboard polls status every few seconds; don't spawn cloudflared --version each time.
 let cached;
 const cloudflaredInfo = (fresh = false) => {
+    // Logins change when a share signs in, and reading them is cheap; only the version check is cached.
+    const zones = (0, cloudflare_logins_1.loggedInZones)();
+    const loggedIn = zones.length > 0 || fs_1.default.existsSync(path_1.default.join(os_1.default.homedir(), ".cloudflared", "cert.pem"));
     if (!fresh && cached && Date.now() - cached.at < 60000)
-        return cached.info;
+        return { ...cached.info, loggedIn, zones };
     const file = (0, exports.cloudflaredPath)();
-    let info = { installed: false };
+    let info = { installed: false, loggedIn, zones };
     if (file) {
         const result = (0, child_process_1.spawnSync)(file, ["--version"], { encoding: "utf8", timeout: 5000, windowsHide: true });
         const version = `${result.stdout || ""}${result.stderr || ""}`.match(/version\s+(\S+)/i)?.[1];
-        info = { installed: result.status === 0, path: file, ...(version ? { version } : {}) };
+        info = { installed: result.status === 0, loggedIn, zones, path: file, ...(version ? { version } : {}) };
     }
     cached = { at: Date.now(), info };
     return info;
@@ -121,7 +127,7 @@ class TunnelManager {
         this.origin = origin;
         this.tunnels = new Map();
     }
-    /** The mapping a public trycloudflare.com Host belongs to. */
+    /** The mapping a public Host (trycloudflare.com or a custom hostname) belongs to. */
     hostFor(publicHost) {
         for (const [host, tunnel] of this.tunnels)
             if (tunnel.publicHost === publicHost)
@@ -132,43 +138,80 @@ class TunnelManager {
         const tunnel = this.tunnels.get(host);
         if (!tunnel)
             return { enabled: false, status: "off" };
-        const { child, publicHost, ...state } = tunnel;
+        const { child, publicHost, abort, ...state } = tunnel;
         return state;
     }
     /** Starts and stops tunnels to match the registry; `retry` also restarts ones that failed. */
     sync(hosts, retry = false) {
-        for (const [host, tunnel] of [...this.tunnels])
-            if (!hosts[host]?.tunnel || (retry && tunnel.status === "error"))
+        for (const [host, tunnel] of [...this.tunnels]) {
+            const entry = hosts[host];
+            if (!entry?.tunnel || (retry && tunnel.status === "error") || tunnel.domain !== (entry.tunnelDomain || undefined))
                 this.stop(host);
+        }
         for (const [host, entry] of Object.entries(hosts))
             if (entry.tunnel && !this.tunnels.has(host))
-                this.start(host);
+                this.start(host, entry.tunnelDomain);
     }
-    start(host) {
+    start(host, domain) {
+        const mode = domain ? "custom" : "quick";
         const file = (0, exports.cloudflaredPath)();
         if (!file) {
-            this.tunnels.set(host, { enabled: true, status: "error", error: "cloudflared is not installed. Run `locadot tunnel:install`." });
+            this.tunnels.set(host, { enabled: true, status: "error", mode, domain, error: "cloudflared is not installed. Run `locadot tunnel:install`." });
             return;
         }
-        const tunnel = { enabled: true, status: "starting" };
+        const tunnel = { enabled: true, status: "starting", mode, domain };
         this.tunnels.set(host, tunnel);
+        if (domain) {
+            this.startCustom(file, host, domain, tunnel);
+            return;
+        }
         // An empty config file keeps a user's ~/.cloudflared/config.yml (named tunnels) out of the way.
         const config = path_1.default.join(constants_1.default.paths.HOME, "cloudflared-quick.yml");
         fs_1.default.writeFileSync(config, "");
-        const child = (0, child_process_1.spawn)(file, ["tunnel", "--no-autoupdate", "--config", config, "--url", this.origin()], {
-            stdio: ["ignore", "pipe", "pipe"],
-            windowsHide: true,
+        this.run(host, tunnel, file, ["tunnel", "--no-autoupdate", "--config", config, "--url", this.origin()], (text) => {
+            const url = text.match(URL_PATTERN)?.[0];
+            if (url)
+                Object.assign(tunnel, { status: "up", url, publicHost: new URL(url).hostname });
+        });
+    }
+    /** Logs in if needed, creates the mapping's own named tunnel and points the hostname's DNS at it, then runs it. */
+    startCustom(file, host, domain, tunnel) {
+        const name = `locadot-${host.replace(/[^a-z0-9-]/gi, "-")}`;
+        tunnel.publicHost = domain;
+        tunnel.abort = new AbortController();
+        (0, cloudflare_logins_1.setupDomainTunnel)(domain, name, (loginUrl) => {
+            if (this.tunnels.get(host) === tunnel)
+                Object.assign(tunnel, { status: "login", loginUrl });
+        }, tunnel.abort.signal)
+            .then(({ cert, credentials }) => {
+            if (this.tunnels.get(host) !== tunnel)
+                return;
+            Object.assign(tunnel, { status: "starting", loginUrl: undefined, abort: undefined });
+            const args = ["tunnel", "--no-autoupdate", "--origincert", cert, "run", ...(credentials ? ["--credentials-file", credentials] : []), "--url", this.origin(), name];
+            this.run(host, tunnel, file, args, (text) => {
+                if (REGISTERED_PATTERN.test(text))
+                    Object.assign(tunnel, { status: "up", url: `https://${domain}` });
+            });
+        })
+            .catch((error) => {
+            if (this.tunnels.get(host) !== tunnel)
+                return;
+            Object.assign(tunnel, { status: "error", error: error?.message || String(error), loginUrl: undefined });
+            logger_1.default.warn(`🌍 tunnel for ${host} failed: ${tunnel.error}`);
         });
+    }
+    run(host, tunnel, file, args, onData) {
+        const child = (0, child_process_1.spawn)(file, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
         tunnel.child = child;
         let tail = "";
         const read = (chunk) => {
             const text = chunk.toString("utf8");
             tail = (tail + text).slice(-2000);
-            const url = text.match(URL_PATTERN)?.[0];
-            if (url && tunnel.status !== "up") {
-                Object.assign(tunnel, { status: "up", url, publicHost: new URL(url).hostname });
-                logger_1.default.info(`🌍 ${host} is public at ${url}`);
-            }
+            if (tunnel.status === "up")
+                return;
+            onData(text);
+            if (tunnel.status === "up")
+                logger_1.default.info(`🌍 ${host} is public at ${tunnel.url}`);
         };
         child.stdout?.on("data", read);
         child.stderr?.on("data", read);
@@ -177,17 +220,19 @@ class TunnelManager {
             if (this.tunnels.get(host) !== tunnel)
                 return;
             const reason = tail.split(/\r?\n/).filter((line) => /ERR|error|failed/i.test(line)).pop()?.trim();
-            Object.assign(tunnel, { status: "error", error: reason || `cloudflared exited (${code})`, url: undefined, publicHost: undefined, child: undefined });
+            Object.assign(tunnel, { status: "error", error: reason || `cloudflared exited (${code})`, url: undefined, child: undefined });
+            if (!tunnel.domain)
+                tunnel.publicHost = undefined;
             logger_1.default.warn(`🌍 tunnel for ${host} stopped: ${tunnel.error}`);
         });
     }
     stop(host) {
         const tunnel = this.tunnels.get(host);
         this.tunnels.delete(host);
-        if (tunnel?.child) {
-            tunnel.child.kill();
+        if (tunnel?.child || tunnel?.status === "login")
             logger_1.default.info(`🌍 ${host} is no longer public`);
-        }
+        tunnel?.child?.kill();
+        tunnel?.abort?.abort();
     }
     stopAll() {
         for (const host of [...this.tunnels.keys()])

package/dist/server/index.js

@@ -67,6 +67,7 @@ async function startCentralProxy() {
         stats,
         lookup: (host) => registry.get().hosts[tunnels.hostFor(host) ?? host],
         tunnelFor: (host) => tunnels.hostFor(host),
+        ownPorts: () => [info.httpPort, info.httpsPort],
         remoteFor: remote_1.remoteFor,
         localFor: remote_1.localFor,
         remoteHosts: (name) => Object.entries(registry.get().hosts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",