locadot 2.6.0 → 2.6.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.6.1 (2026-09-30)
+
+### Fixed
+- `startup:enable` on ports 80/443 now asks for admin rights. macOS only lets non-root bind ports below 1024 on
+  all interfaces, and locadot listens on loopback, so the login LaunchAgent couldn't bind; it now installs a root
+  LaunchDaemon (after a password prompt), and `sudo startup:enable` no longer drops the job to your user. On Linux
+  a terminal gets a plain `sudo` prompt instead of a desktop-only dialog, and a missing prompt fails with a clear
+  message. The dashboard and `doctor` report on macOS that 80/443 need root.
+
 ## 2.6.0 (2026-09-30)
 
 ### Added

package/README.md

@@ -215,7 +215,7 @@ working on the same URL, since they authenticate with their own tokens. Some det
 | `locadot clear:logs` | Clear the log file. |
 | `locadot path` | Show every file locadot uses. `path:logs` and `path:hosts` print a single path. |
 | `locadot token` | Print the dashboard API token, for scripts and AI agents. |
-| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron; macOS LaunchDaemon with `sudo`, running as you) or logon (macOS LaunchAgent without `sudo`; a hidden script in the Windows Startup folder, no admin needed). |
+| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron; macOS LaunchDaemon) or logon (macOS LaunchAgent; a hidden script in the Windows Startup folder, no admin needed). On ports below 1024 it asks for your password (sudo in a terminal, the system dialog from the dashboard), since macOS and Linux need root to bind them on loopback; the boot job then runs as root. |
 
 ---
 

package/dist/cli/commands/doctor.js

@@ -11,6 +11,7 @@ const proxy_control_1 = __importDefault(require("../../lib/proxy-control"));
 const registry_1 = __importDefault(require("../../lib/registry"));
 const constants_1 = __importDefault(require("../../constants"));
 const trust_1 = require("../../utils/trust");
+const startup_1 = require("../../utils/startup");
 const shared_1 = require("../shared");
 async function doctor(options) {
     let failures = 0;
@@ -46,6 +47,9 @@ async function doctor(options) {
         const canBind = process.getuid?.() === 0 || unprivileged <= Math.min(constants_1.default.server.httpPort, constants_1.default.server.httpsPort);
         check(canBind || Boolean(info), "Allowed to bind ports 80/443", "Run with sudo, or allow it once: `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80` (persist in /etc/sysctl.d/).");
     }
+    if (os_1.default.platform() === "darwin" && (0, startup_1.macLowPortsNeedRoot)()) {
+        check(process.getuid?.() === 0 || Boolean(info), "Allowed to bind ports 80/443", "macOS lets non-root bind ports below 1024 only on all interfaces, and locadot listens on loopback. Run `sudo locadot start`.");
+    }
     const trusted = await (0, trust_1.isCATrusted)().catch(() => false);
     check(trusted, "Locadot CA trusted by the system", `Run \`locadot trust\`. Manual steps:\n${(0, trust_1.trustInstructions)()}`);
     try {

package/dist/lib/system.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -8,7 +41,7 @@ exports.systemStatus = systemStatus;
 const fs_1 = __importDefault(require("fs"));
 const child_process_1 = require("child_process");
 const constants_1 = __importDefault(require("../constants"));
-const startup_1 = __importDefault(require("../utils/startup"));
+const startup_1 = __importStar(require("../utils/startup"));
 const trust_1 = require("../utils/trust");
 let windowsAdmin;
 /** Root on POSIX; on Windows `net session` only succeeds in an elevated shell. */
@@ -38,9 +71,13 @@ const unprivilegedPortStart = () => {
     }
 };
 exports.unprivilegedPortStart = unprivilegedPortStart;
-/** macOS (since 10.14) and Windows let any user bind 80/443; Linux depends on the sysctl. */
+/** Windows lets any user bind 80/443; macOS only on the wildcard address; Linux depends on the sysctl. */
 const canBindPrivileged = () => {
-    if (process.platform !== "linux" || (0, exports.isElevated)())
+    if (process.platform === "win32" || (0, exports.isElevated)())
+        return true;
+    if (process.platform === "darwin")
+        return !(0, startup_1.macLowPortsNeedRoot)();
+    if (process.platform !== "linux")
         return true;
     const start = (0, exports.unprivilegedPortStart)();
     return start !== null && start <= Math.min(constants_1.default.server.httpPort, constants_1.default.server.httpsPort);

package/dist/utils/startup.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.windowsLauncherScript = exports.macPlist = exports.macDirs = void 0;
+exports.macLowPortsNeedRoot = exports.privilege = exports.elevate = exports.windowsLauncherScript = exports.macPlist = exports.macDirs = void 0;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_1 = __importDefault(require("fs"));
@@ -135,6 +135,38 @@ function execSudo(cmd) {
         });
     });
 }
+/**
+ * In a terminal, plain sudo asks for the password right there. Elsewhere (the dashboard's proxy) sudo-prompt shows
+ * the system dialog: osascript on macOS, pkexec or kdesudo on Linux, which servers and SSH sessions often lack.
+ */
+const elevate = async (cmd, command) => {
+    if (process.stdin.isTTY) {
+        logger_1.default.info("The boot job for ports below 1024 runs as root; sudo will ask for your password.");
+        const result = (0, child_process_1.spawnSync)("sudo", ["sh", "-c", cmd], { stdio: "inherit", windowsHide: true });
+        if (!result.error) {
+            if (result.status === 0)
+                return;
+            throw new Error(`sudo failed (${result.status ?? result.signal}).`);
+        }
+    }
+    try {
+        await execSudo(`sh -c ${quote(cmd)}`);
+    }
+    catch (error) {
+        throw new Error(`This needs admin rights and no password prompt is available here (${String(error?.message || error).trim()}). ` +
+            `Run \`${command}\` in a terminal.`);
+    }
+};
+exports.elevate = elevate;
+// Tests swap this out.
+exports.privilege = { run: exports.elevate };
+/**
+ * macOS (10.14+) lets any user bind ports below 1024, but only on the wildcard address. locadot listens on loopback
+ * by default, so 80/443 still need root there.
+ */
+const macLowPortsNeedRoot = () => Math.min(constants_1.default.server.httpPort, constants_1.default.server.httpsPort) < 1024 &&
+    constants_1.default.server.bind.some((host) => host !== "0.0.0.0" && host !== "::");
+exports.macLowPortsNeedRoot = macLowPortsNeedRoot;
 /** Linux needs root for ports below 1024 unless the sysctl allows otherwise. */
 const linuxNeedsRoot = () => {
     if (process.getuid?.() === 0)
@@ -168,7 +200,7 @@ class Startup {
                 const line = `@reboot ${env} ${[command, ...args].map(quote).join(" ")} >> ${quote(constants_1.default.paths.LOGS)} 2>&1 ${CRON_MARK}`;
                 const edit = cronEdit(line);
                 if (linuxNeedsRoot()) {
-                    await execSudo(`sh -c ${quote(edit)}`);
+                    await exports.privilege.run(edit, "locadot startup:enable");
                     method = "root-crontab";
                 }
                 else {
@@ -182,23 +214,41 @@ class Startup {
                 // LaunchAgents at login and LaunchDaemons at boot on its own.
                 const target = macTarget();
                 const argv = [command, ...args.slice(0, -1), target.state];
+                const needsRoot = (0, exports.macLowPortsNeedRoot)();
                 if (target.root) {
-                    // Root mode: a LaunchDaemon starts at boot, before anyone logs in, as the sudo user when there is one.
+                    // Root mode: a LaunchDaemon starts at boot, before anyone logs in, as the sudo user when there is one
+                    // and the ports don't need root.
+                    const user = needsRoot ? undefined : target.user;
                     fs_1.default.mkdirSync(exports.macDirs.daemons, { recursive: true });
-                    fs_1.default.writeFileSync(daemonPath(), (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, user: target.user, home: target.user ? target.home : undefined, env: userPortVars() }));
+                    fs_1.default.writeFileSync(daemonPath(), (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, user, home: target.user ? target.home : undefined, env: userPortVars() }));
                     // launchd skips daemon plists that aren't root-owned or are group/world writable.
                     fs_1.default.chmodSync(daemonPath(), 0o644);
                     fs_1.default.rmSync(agentPath(target.home), { force: true });
                     launchctlEnable("system");
                     method = "launch-daemon";
                 }
+                else if (needsRoot) {
+                    // A LaunchAgent runs as the user and couldn't bind, so install a root LaunchDaemon, asking for the password.
+                    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "locadot-daemon-"));
+                    const tmp = path_1.default.join(dir, `${MAC_LABEL}.plist`);
+                    fs_1.default.writeFileSync(tmp, (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, home: target.home, env: userPortVars() }));
+                    try {
+                        await exports.privilege.run(`mkdir -p ${quote(exports.macDirs.daemons)} && install -m 644 -o root -g wheel ${quote(tmp)} ${quote(daemonPath())} && ` +
+                            `(launchctl enable system/${MAC_LABEL} || true)`, "locadot startup:enable");
+                    }
+                    finally {
+                        fs_1.default.rmSync(dir, { recursive: true, force: true });
+                    }
+                    fs_1.default.rmSync(agentPath(target.home), { force: true });
+                    method = "launch-daemon";
+                }
                 else {
                     // macOS (10.14+) lets unprivileged processes bind 80/443, so a user LaunchAgent is enough. It starts at login.
                     fs_1.default.mkdirSync(path_1.default.dirname(agentPath()), { recursive: true });
                     fs_1.default.writeFileSync(agentPath(), (0, exports.macPlist)(MAC_LABEL, argv, { state: target.state, env: userPortVars() }));
                     fs_1.default.chmodSync(agentPath(), 0o644);
                     if (fs_1.default.existsSync(daemonPath()))
-                        await execSudo(`rm -f ${quote(daemonPath())}`);
+                        await exports.privilege.run(`rm -f ${quote(daemonPath())}`, "locadot startup:enable");
                     launchctlEnable(`gui/${process.getuid?.()}`);
                     method = "launch-agent";
                 }
@@ -230,7 +280,7 @@ class Startup {
                 break;
             case "linux":
                 if (method === "root-crontab")
-                    await execSudo(`sh -c ${quote(cronEdit())}`);
+                    await exports.privilege.run(cronEdit(), "locadot startup:disable");
                 else
                     (0, child_process_1.execFileSync)("sh", ["-c", cronEdit()], { stdio: "inherit", windowsHide: true });
                 break;
@@ -242,7 +292,7 @@ class Startup {
                     if (target.root)
                         fs_1.default.rmSync(daemonPath(), { force: true });
                     else
-                        await execSudo(`rm -f ${quote(daemonPath())}`);
+                        await exports.privilege.run(`rm -f ${quote(daemonPath())}`, "locadot startup:disable");
                 }
                 fs_1.default.rmSync(markerIn(target.state), { force: true });
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",