locadot 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.4.0 (2026-09-29)
+
+### Added
+- Password protection per mapping: `locadot protect --host app.localhost --shared --remote --local` (or the lock on a
+  row in the dashboard) asks for a password on the shared link, for connected machines and/or locally, whichever you
+  pick; none by default. Visitors sign in on a locadot page and get a cookie for that host that isn't sent upstream.
+  `PUT /api/hosts/:host {"protect": {"password": "…", "scopes": [...]}}`, `{"protect": null}` to remove.
+
+### Fixed
+- Sharing on a custom domain used whatever Cloudflare login was on the machine, so a hostname outside that login's zone
+  showed as live while cloudflared had created `<hostname>.<other zone>` instead. locadot now keeps one login per zone,
+  signs you in for the hostname's zone when it has none (the dashboard's Share dialog opens Cloudflare in a new tab and
+  follows the sign-in until the share is live), and fails with a clear error when the authorized zone doesn't include it.
+- `locadot tunnel --host …` retries a share that failed; it used to report the old error again.
+
 ## 2.3.0 (2026-09-29)
 
 ### Added

package/README.md

@@ -65,6 +65,7 @@ npx locadot open                                    # opens the dashboard at htt
 | `locadot add --host <name>.localhost --target <url>` | Map a domain to any upstream: `3000`, `127.0.0.1:8080`, `http://10.0.0.5:8080/app`, `https://google.com`. |
 | `locadot update --host <name>.localhost --port/--target …` | Change the destination of an existing domain. |
 | `locadot remove --host <name>.localhost` (`rm`) | Remove a domain. |
+| `locadot protect --host <name>.localhost [--shared] [--remote] [--local] [--stdin] [--off]` | Ask for a password on the shared link, for connected machines and/or locally (none by default). Prompts for the password, or reads it with `--stdin`. |
 | `locadot allow --host <name>.localhost [addresses…] [--rm] [--clear]` | Let people on a tunnel or remote access reach internal addresses (`localhost:3000`) through a `--cors` domain. With no addresses, shows the list. Also `add … --allow a,b`. |
 | `locadot list` (`ls`, `host`) `[--json]` | Show all mappings. |
 | `locadot clear:hosts` | Remove all mappings. |
@@ -96,7 +97,7 @@ Options for `add` / `update`:
 | Command | What it does |
 | --- | --- |
 | `locadot tunnel --host app.localhost` | Share a mapping on a public `https://<random>.trycloudflare.com` URL through a Cloudflare quick tunnel. No Cloudflare account is needed. `cloudflared` is downloaded on first use. |
-| `locadot tunnel --host app.localhost --domain app.example.com` | Share it on your own hostname instead, on a domain in your Cloudflare account. The first time, `cloudflared` asks you to log in (the link is printed, and shown on the row in the dashboard). locadot creates a named tunnel for the mapping (`locadot-app-localhost`), points the hostname's DNS at it (replacing an existing record) and runs it. The URL stays the same across restarts. |
+| `locadot tunnel --host app.localhost --domain app.example.com` | Share it on your own hostname instead, on a domain in your Cloudflare account. If locadot has no Cloudflare login for the hostname's zone, it asks you to sign in and authorize that zone (the link is printed; the dashboard opens it in a new tab). Each zone you authorize is kept in the state dir, so domains in different zones or accounts each get their own login; `~/.cloudflared/cert.pem` is used but never replaced. If the zone you authorize doesn't include the hostname, sharing fails with an error rather than going live on the wrong name. locadot creates a named tunnel for the mapping (`locadot-app-localhost`), points the hostname's DNS at it (replacing an existing record) and runs it. The URL stays the same across restarts. |
 | `locadot tunnel --host app.localhost --off` | Stop sharing it. The custom hostname is remembered for the dashboard; sharing again without `--domain` uses a random URL. |
 | `locadot tunnel` | List the shared mappings and their public URLs. |
 | `locadot tunnel:install` | Download `cloudflared` into the state dir (`<state>/bin`). Set `LOCADOT_CLOUDFLARED` to use your own binary; one on `PATH` is also picked up. |
@@ -120,6 +121,20 @@ In the dashboard, click **Access** on the row. An entry is `host:port`, or a hos
 and `0.0.0.0` count as `localhost`. Only the page's own requests can use it, and locadot's own ports stay blocked even
 when all of `localhost` is allowed. Allow only what the app needs: anyone who can open the mapping can reach these addresses.
 
+**Password protection.** Ask for a password before a mapping opens, only where you choose: on the shared link, for
+machines connected through remote access, and/or locally (this machine and your network). Nothing is picked by default.
+
+```sh
+locadot protect --host app.localhost --shared           # prompts for the password; --stdin reads it from a pipe
+locadot protect --host app.localhost --shared --local   # change where it asks, keeping the password
+locadot protect --host app.localhost                     # set a new password (signs everyone out)
+locadot protect --host app.localhost --off
+```
+
+In the dashboard, click the lock on the row. Visitors get a sign-in page and stay signed in for 7 days through a cookie
+for that host, which is never passed on to your app. Ten wrong passwords in five minutes lock that visitor out for a
+while. Passwords are stored as scrypt hashes in `.locadot-host-passwords.json` (0600), not in the registry.
+
 ### Remote access (locadot to locadot)
 
 One machine (the sender) publishes its whole locadot on a Cloudflare hostname. Other machines (receivers) connect with a
@@ -262,6 +277,7 @@ each time the proxy starts.
 | `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
 | `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
 | `PUT /api/hosts/:host` | `{ "allow": ["localhost:3000"] }` | Replace the internal addresses shared visitors may reach (normalized; `[]` clears; 400 if one is invalid). |
+| `PUT /api/hosts/:host` | `{ "protect": { "password": "…", "scopes": ["shared", "remote", "local"] } }` | Ask for a password on those paths in (at least one; `password` may be left out to keep the current one). `{ "protect": null }` removes it. Rows show `protect: { scopes, updatedAt }`, never the password. |
 | `PUT /api/hosts/:host` | `{ "tunnel": true, "domain": "app.example.com" }` | Share on a public URL: with `domain`, on that hostname through a named Cloudflare tunnel, without it on a random trycloudflare.com URL. `{ "tunnel": false }` stops sharing (400 for a bad hostname, 409 if another mapping uses it). |
 | `DELETE /api/hosts/:host` | | Remove a mapping. |
 | `POST /api/startup` | `{ "enabled": true }` | Start at boot on/off. |

package/dist/cli/commands/hosts.js

@@ -126,7 +126,7 @@ async function list(options) {
     }
     const width = Math.max(...hosts.map(([host]) => (0, urls_1.urlFor)(host).length));
     for (const [host, entry] of hosts) {
-        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}`);
+        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}${entry.protect ? `  (password: ${entry.protect.scopes.join(", ")})` : ""}`);
     }
     (0, shared_1.print)(`☑️ Total: ${hosts.length}.`);
 }

package/dist/cli/commands/index.js

@@ -40,6 +40,7 @@ const system = __importStar(require("./system"));
 const tunnel = __importStar(require("./tunnel"));
 const remote = __importStar(require("./remote"));
 const ui = __importStar(require("./ui"));
+const protect_1 = require("./protect");
 const doctor_1 = require("./doctor");
-const Commands = { ...hosts, ...proxy, ...files, ...system, ...tunnel, ...remote, ...ui, doctor: doctor_1.doctor };
+const Commands = { ...hosts, ...proxy, ...files, ...system, ...tunnel, ...remote, ...ui, protect: protect_1.protect, doctor: doctor_1.doctor };
 exports.default = Commands;

package/dist/cli/commands/protect.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protect = protect;
+const localhost_1 = __importStar(require("../../lib/localhost"));
+const hosts_1 = __importDefault(require("../../lib/hosts"));
+const host_auth_1 = __importStar(require("../../lib/host-auth"));
+const registry_1 = __importDefault(require("../../lib/registry"));
+const urls_1 = require("../../lib/urls");
+const shared_1 = require("../shared");
+const ui_1 = require("./ui");
+const PLACES = { shared: "the shared link", remote: "connected machines", local: "this machine" };
+/** Asks for a password on a mapping, on the paths picked with --shared/--remote/--local; --off removes it. */
+async function protect(options) {
+    const host = localhost_1.default.requireHost(options.host);
+    if (options.off) {
+        await hosts_1.default.setProtect({ host, off: true });
+        (0, shared_1.print)(`🔓 ${(0, urls_1.urlFor)(host)} no longer asks for a password.`);
+        return;
+    }
+    const entry = registry_1.default.read().hosts[host];
+    if (!entry)
+        throw new localhost_1.InputError(`❌ ${host} isn't mapped. Add it first: locadot add --host ${host} --port <port>`);
+    const picked = host_auth_1.SCOPES.filter((scope) => options[scope]);
+    const scopes = picked.length ? picked : entry.protect?.scopes ?? [];
+    if (!scopes.length)
+        throw new localhost_1.InputError(`❌ Pick where to ask for the password: --shared, --remote and/or --local.`);
+    let password = options.password;
+    // Picking places for an already protected mapping keeps its password; otherwise ask for one.
+    if (password === undefined && (options.stdin || !host_auth_1.default.has(host) || !picked.length)) {
+        if (options.stdin || !process.stdin.isTTY)
+            password = await (0, ui_1.readStdin)();
+        else {
+            password = await (0, ui_1.askHidden)(`Password for ${host}: `);
+            if ((await (0, ui_1.askHidden)("Repeat it: ")) !== password)
+                throw new localhost_1.InputError("❌ The passwords don't match.");
+        }
+    }
+    const { entry: saved } = await hosts_1.default.setProtect({ host, password, scopes });
+    (0, shared_1.print)(`🔒 ${(0, urls_1.urlFor)(host)} asks for a password on ${saved.protect.scopes.map((scope) => PLACES[scope]).join(", ")}.`);
+}

package/dist/cli/commands/tunnel.js

@@ -91,6 +91,17 @@ async function tunnel(options) {
     }
     if (!(0, tunnel_1.cloudflaredInfo)(true).installed)
         await installTunnel();
+    // The proxy leaves a failed tunnel alone when the registry doesn't change, so clear it first to retry.
+    const current = await tunnelRows().then((rows) => rows.find((row) => row.host === host)?.tunnel, () => undefined);
+    if (current?.status === "error") {
+        await hosts_1.default.setTunnel({ host, tunnel: false });
+        for (let i = 0; i < 20; i++) {
+            const state = await tunnelRows().then((rows) => rows.find((row) => row.host === host)?.tunnel, () => undefined);
+            if (!state || state.status === "off")
+                break;
+            await new Promise((resolve) => setTimeout(resolve, 250));
+        }
+    }
     await hosts_1.default.setTunnel({ host, tunnel: true, domain: options.domain });
     await (0, shared_1.ensureRunning)();
     let deadline = Date.now() + TUNNEL_TIMEOUT_MS;
@@ -100,7 +111,7 @@ async function tunnel(options) {
         if (state?.status === "login" && state.loginUrl && !loginShown) {
             loginShown = true;
             deadline = Date.now() + 10 * 60000;
-            (0, shared_1.print)(`🔑 Log in to Cloudflare to finish: ${state.loginUrl}`);
+            (0, shared_1.print)(`🔑 Log in to Cloudflare to finish${state.domain ? ` and pick the zone ${state.domain} is in` : ""}: ${state.loginUrl}`);
         }
         if (state?.status === "up") {
             (0, shared_1.print)(`🌍 ${host} is public at ${state.url}`);

package/dist/cli/commands/ui.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.askHidden = exports.readStdin = void 0;
 exports.uiPassword = uiPassword;
 const readline_1 = __importDefault(require("readline"));
 const localhost_1 = require("../../lib/localhost");
@@ -48,6 +49,7 @@ const readStdin = () => new Promise((resolve, reject) => {
     process.stdin.on("end", () => resolve(data.split(/\r?\n/)[0]));
     process.stdin.on("error", reject);
 });
+exports.readStdin = readStdin;
 /** Reads a line without echoing it. */
 const askHidden = (question) => new Promise((resolve) => {
     const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
@@ -66,6 +68,7 @@ const askHidden = (question) => new Promise((resolve) => {
         resolve(answer);
     });
 });
+exports.askHidden = askHidden;
 /** Sets, resets or removes the dashboard password. Works whether or not the proxy is running. */
 async function uiPassword(options) {
     if (options.off) {
@@ -76,11 +79,11 @@ async function uiPassword(options) {
     }
     let password;
     if (options.stdin || !process.stdin.isTTY) {
-        password = await readStdin();
+        password = await (0, exports.readStdin)();
     }
     else {
-        password = await askHidden("New dashboard password: ");
-        const again = await askHidden("Repeat it: ");
+        password = await (0, exports.askHidden)("New dashboard password: ");
+        const again = await (0, exports.askHidden)("Repeat it: ");
         if (password !== again)
             throw new localhost_1.InputError("❌ The passwords don't match.");
     }

package/dist/constants/index.js

@@ -55,6 +55,7 @@ Constants.paths = {
     CONFIG_FILE,
     // Optional dashboard password: scrypt hash + session signing secret (0600).
     UI_AUTH_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-ui-auth.json"),
+    HOST_PASSWORDS_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-host-passwords.json"),
     // Remote access. Sender: public hostname config, invites + peers (0600). Receiver: remotes (0600).
     HUB_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-hub.json"),
     LINKS_FILE: path_1.default.join(PACKAGE_PATH, ".locadot-links.json"),

package/dist/dashboard/api.js

@@ -419,7 +419,17 @@ async function route(req, url, ctx) {
                 updated = await hosts_1.default.setAllow({ host, allow: body.allow });
                 logger_1.default.info(`✏️ dashboard: ${updated.host} allows ${updated.entry.allow?.join(", ") || "no internal addresses"}`);
             }
-            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined)) {
+            if (body.protect !== undefined) {
+                const protect = body.protect;
+                if (protect !== null && (typeof protect !== "object" || Array.isArray(protect)))
+                    throw new ApiError(400, "protect must be an object or null.");
+                updated = protect === null
+                    ? await hosts_1.default.setProtect({ host, off: true })
+                    : await hosts_1.default.setProtect({ host, password: protect.password, scopes: protect.scopes });
+                const scopes = updated.entry.protect?.scopes;
+                logger_1.default.info(`🔒 dashboard: ${scopes ? `${updated.host} asks for a password on ${scopes.join(", ")}${protect?.password ? " (new password)" : ""}` : `${updated.host} is no longer password protected`}`);
+            }
+            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined && body.protect === undefined)) {
                 updated = await hosts_1.default.update({
                     host,
                     target: body.target,

package/dist/dashboard/index.js

@@ -38,6 +38,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleDashboardRequest = handleDashboardRequest;
 const crypto_1 = __importDefault(require("crypto"));
+const host_auth_1 = __importDefault(require("../lib/host-auth"));
 const page_1 = require("./page");
 const api_1 = require("./api");
 const request_1 = require("../proxy/request");
@@ -93,6 +94,7 @@ async function buildHosts(ctx) {
             cors: !!entry.cors,
             allow: entry.allow ?? [],
             tunnelDomain: entry.tunnelDomain ?? null,
+            protect: entry.protect ? { scopes: entry.protect.scopes, updatedAt: host_auth_1.default.updatedAt(host) ?? null } : null,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),