localdeck 1.0.3 → 1.1.0

package/dist/{index-3qpxpxwq.js → index-n4sq4z00.js}

@@ -3226,6 +3226,22 @@ function normalize(raw, file) {
         Object.defineProperty(env, key, { value: value2, enumerable: true, writable: true, configurable: true });
       }
     }
+    let secrets;
+    if (entry.secrets !== undefined) {
+      if (!Array.isArray(entry.secrets) || !entry.secrets.every((value2) => typeof value2 === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value2))) {
+        throw new Error(`${path2.basename(file)}: secrets must contain valid environment names`);
+      }
+      secrets = [];
+      for (const secret of entry.secrets) {
+        if (secret === "PORT" || secret.startsWith("LOCALDECK_"))
+          throw new Error(`${path2.basename(file)}: ${secret} is reserved by LocalDeck`);
+        if (env && Object.prototype.hasOwnProperty.call(env, secret))
+          throw new Error(`${path2.basename(file)}: ${secret} cannot be both a secret and env setting`);
+        if (secrets.includes(secret))
+          throw new Error(`${path2.basename(file)}: duplicate secret ${secret}`);
+        secrets.push(secret);
+      }
+    }
     out.push({
       name,
       run,
@@ -3236,7 +3252,8 @@ function normalize(raw, file) {
       after: [...new Set(after)],
       ready: parseReadiness(entry.ready ?? (serviceType === "postgres" || serviceType === "redis" ? serviceType : undefined), file, index),
       ...serviceType ? { serviceType } : {},
-      ...env ? { env } : {}
+      ...env ? { env } : {},
+      ...secrets ? { secrets } : {}
     });
   }
   validateDependencies(out, file);
@@ -3392,9 +3409,9 @@ function stopOrder(commands) {
 }
 
 // ../daemon/src/index.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import crypto2 from "node:crypto";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // ../daemon/src/api.ts
 import http5 from "node:http";
@@ -3687,34 +3704,55 @@ class CleanUrls {
 }
 
 // ../daemon/src/api.ts
-import fs5 from "node:fs";
-import path6 from "node:path";
+import fs6 from "node:fs";
+import path7 from "node:path";
 
 // ../daemon/src/request-body.ts
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 var MAX_BODY_CAPTURE_BYTES = 16384;
 
 class BodyCapture {
+  limit;
   chunks = [];
   retained = 0;
   bytes = 0;
+  tailUsed = 0;
+  constructor(limit = MAX_BODY_CAPTURE_BYTES) {
+    this.limit = limit;
+  }
   append(chunk) {
     this.bytes += chunk.length;
-    const count = Math.min(chunk.length, MAX_BODY_CAPTURE_BYTES - this.retained);
-    if (count > 0) {
-      this.chunks.push(Buffer.from(chunk.subarray(0, count)));
-      this.retained += count;
+    const count = Math.min(chunk.length, this.limit - this.retained);
+    let offset = 0;
+    while (offset < count) {
+      let tail = this.chunks.at(-1);
+      if (!tail || this.tailUsed === tail.length) {
+        if (tail && tail.length < 4096) {
+          const grown = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained + this.tailUsed, Math.max(tail.length * 2, count - offset)));
+          tail.copy(grown, 0, 0, this.tailUsed);
+          this.chunks[this.chunks.length - 1] = tail = grown;
+        } else {
+          tail = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained, Math.max(64, count - offset)));
+          this.chunks.push(tail);
+          this.tailUsed = 0;
+        }
+      }
+      const size = Math.min(count - offset, tail.length - this.tailUsed);
+      chunk.copy(tail, this.tailUsed, offset, offset + size);
+      this.tailUsed += size;
+      this.retained += size;
+      offset += size;
     }
   }
   snapshot(complete, contentEncoding) {
-    let buffer = Buffer.concat(this.chunks, this.retained);
+    let buffer = Buffer.concat(this.chunks.map((chunk, index) => index === this.chunks.length - 1 ? chunk.subarray(0, this.tailUsed) : chunk), this.retained);
     let encoded = Boolean(contentEncoding && contentEncoding !== "identity");
     const truncated = this.bytes > this.retained;
     if (encoded && complete && !truncated && buffer.length) {
       const decode = { gzip: gunzipSync, deflate: inflateSync, br: brotliDecompressSync }[contentEncoding];
       try {
         if (decode) {
-          buffer = decode(buffer, { maxOutputLength: MAX_BODY_CAPTURE_BYTES });
+          buffer = decode(buffer, { maxOutputLength: this.limit });
           encoded = false;
         }
       } catch {}
@@ -3786,6 +3824,11 @@ function proxyRequest(req, res, target, hooks) {
   const requestHeaders = captureHeaders(req.rawHeaders);
   const requestBody = new BodyCapture;
   const responseBody = new BodyCapture;
+  const fullResponse = hooks.responseBodies?.start(target.service);
+  const captureResponse = (chunk) => {
+    responseBody.append(chunk);
+    fullResponse?.append(chunk);
+  };
   let responseComplete = false;
   let responseEncoding;
   let responseHeaders;
@@ -3795,6 +3838,7 @@ function proxyRequest(req, res, target, hooks) {
     if (recorded)
       return;
     recorded = true;
+    fullResponse?.finish(responseComplete, responseEncoding);
     hooks.onRequest({
       ts: started,
       service: target.service,
@@ -3808,14 +3852,15 @@ function proxyRequest(req, res, target, hooks) {
       requestHeaders,
       responseHeaders,
       requestBody: requestBody.snapshot(req.readableEnded, req.headers["content-encoding"]),
-      responseBody: responseBody.snapshot(responseComplete, responseEncoding)
+      responseBody: responseBody.snapshot(responseComplete, responseEncoding),
+      responseBodyId: fullResponse?.id
     });
   };
   if (!target.upstreamReady) {
     responseHeaders = captureHeaders(["content-type", "text/html; charset=utf-8", "retry-after", "2"]);
     res.writeHead(503, { "content-type": "text/html; charset=utf-8", "retry-after": "2" });
     const body = waitingPage(target);
-    responseBody.append(Buffer.from(body));
+    captureResponse(Buffer.from(body));
     responseComplete = true;
     res.end(body);
     record(503, "upstream not ready");
@@ -3847,7 +3892,7 @@ function proxyRequest(req, res, target, hooks) {
     res.writeHead(up.statusCode ?? 502, up.statusMessage, headers);
     up.on("data", (chunk) => {
       bytes += chunk.length;
-      responseBody.append(chunk);
+      captureResponse(chunk);
     });
     up.pipe(res);
   });
@@ -3857,7 +3902,7 @@ function proxyRequest(req, res, target, hooks) {
     if (!res.headersSent && !res.destroyed) {
       res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
       const body = `LocalDeck: upstream ${target.service} (${target.upstreamHost}:${target.upstreamPort}) error: ${err.code ?? err.message}`;
-      responseBody.append(Buffer.from(body));
+      captureResponse(Buffer.from(body));
       responseComplete = true;
       res.end(body);
     } else
@@ -4423,13 +4468,13 @@ class ShareManager {
         res.writeHead(401, { "content-type": "text/html; charset=utf-8" }).end(loginPage(name, false));
         return;
       }
-      proxyRequest(req, res, target, { onRequest: (r) => this.store.request(r) });
+      proxyRequest(req, res, target, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
     });
     gate.on("upgrade", (req, socket, head) => {
       const target = this.registry.target(key, "share");
       if (!target || !authed(req))
         return socket.destroy();
-      proxyUpgrade(req, socket, head, target, { onRequest: (r) => this.store.request(r) });
+      proxyUpgrade(req, socket, head, target, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
     });
     const sockets = new Set;
     gate.on("connection", (socket) => {
@@ -5005,6 +5050,98 @@ function replayRequest(service, record, options = {}) {
   });
 }
 
+// ../daemon/src/project-secrets.ts
+import fs5 from "node:fs";
+import path6 from "node:path";
+var ID = /^[a-f0-9]{16}$/;
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+class ProjectSecretError extends Error {
+}
+function validateName(name) {
+  if (!NAME.test(name) || name === "PORT" || name.startsWith("LOCALDECK_")) {
+    throw new ProjectSecretError("invalid secret name");
+  }
+}
+function createProjectSecretStore(home = HOME_DIR) {
+  const directory = path6.join(home, "secrets");
+  function secretPath(projectId2) {
+    if (!ID.test(projectId2))
+      throw new ProjectSecretError("invalid project ID");
+    return path6.join(directory, `${projectId2}.json`);
+  }
+  function read(projectId2) {
+    const file = secretPath(projectId2);
+    let text;
+    try {
+      text = fs5.readFileSync(file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return Object.create(null);
+      throw new ProjectSecretError("Could not read stored secrets");
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new ProjectSecretError("stored secrets are corrupt");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new ProjectSecretError("stored secrets are corrupt");
+    }
+    const values = Object.create(null);
+    for (const [name, value] of Object.entries(parsed)) {
+      validateName(name);
+      if (typeof value !== "string" || !value || value.includes("\x00")) {
+        throw new ProjectSecretError("stored secrets are corrupt");
+      }
+      values[name] = value;
+    }
+    return values;
+  }
+  function write(projectId2, values) {
+    const file = secretPath(projectId2);
+    fs5.mkdirSync(directory, { recursive: true, mode: 448 });
+    if (process.platform !== "win32")
+      fs5.chmodSync(directory, 448);
+    writePrivateJson(file, values);
+  }
+  function listProjectSecrets(projectId2) {
+    return Object.keys(read(projectId2)).sort();
+  }
+  function setProjectSecret(projectId2, name, value) {
+    validateName(name);
+    if (typeof value !== "string" || !value || value.includes("\x00")) {
+      throw new ProjectSecretError("secret value must be a nonempty string without NUL");
+    }
+    const values = read(projectId2);
+    values[name] = value;
+    write(projectId2, values);
+  }
+  function deleteProjectSecret(projectId2, name) {
+    validateName(name);
+    const values = read(projectId2);
+    delete values[name];
+    write(projectId2, values);
+  }
+  function resolveProjectSecrets(projectId2, names) {
+    const output = Object.create(null);
+    if (!names.length)
+      return output;
+    const values = read(projectId2);
+    for (const name of names) {
+      validateName(name);
+      if (!Object.prototype.hasOwnProperty.call(values, name)) {
+        throw new ProjectSecretError(`Add ${name} in Project → Secrets.`);
+      }
+      output[name] = values[name];
+    }
+    return output;
+  }
+  return { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets };
+}
+var { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets } = createProjectSecretStore();
+
 // ../daemon/src/api.ts
 var MIME = { ".html": "text/html; charset=utf-8", ".js": "text/javascript", ".css": "text/css", ".svg": "image/svg+xml", ".json": "application/json", ".png": "image/png", ".ico": "image/x-icon", ".woff": "font/woff", ".woff2": "font/woff2" };
 var MAX_BODY_BYTES = 65536;
@@ -5162,7 +5299,7 @@ function localRequestError(req, allowedBrowserOrigins) {
 function createApiServer(deps) {
   const { registry, store, shares } = deps;
   const allowedBrowserOrigins = validatedBrowserOrigins(deps.allowedBrowserOrigins);
-  const hooks = { onRequest: (r) => store.request(r) };
+  const hooks = { responseBodies: store.responseBodies, onRequest: (r) => store.request(r) };
   const forwarderIdentity = randomUUID();
   const forwarder = new CleanUrls(() => {
     const address = server.address();
@@ -5216,6 +5353,8 @@ function createApiServer(deps) {
     } catch (error) {
       if (error instanceof HttpError)
         return json(res, error.status, { error: error.message });
+      if (error instanceof ProjectSecretError)
+        return json(res, 422, { error: error.message });
       if (error instanceof ProjectError)
         return json(res, projectStatus(error.code), { error: error.message });
       return json(res, 500, { error: "internal server error" });
@@ -5354,6 +5493,31 @@ async function handleApi(req, res, url, parts, deps) {
     }
     if (parts.length >= 2 && parts[1] !== "remember") {
       const projectId2 = parts[1];
+      if (parts.length === 3 && parts[2] === "secrets" && method === "GET") {
+        const project = requireRememberedProject(projects, projectId2);
+        if (!project.available)
+          throw new ProjectError("invalid", project.error ?? "project configuration is invalid");
+        const list = deps.listProjectSecrets ?? listProjectSecrets;
+        const declared = project.commands.flatMap((command) => command.secrets ?? []);
+        const stored = new Set(list(projectId2));
+        const names = [...new Set([...declared, ...stored])].sort();
+        return json(res, 200, { secrets: names.map((name) => ({ name, configured: stored.has(name) })) });
+      }
+      if (parts.length === 4 && parts[2] === "secrets" && (method === "PUT" || method === "DELETE")) {
+        requireMutationAllowed(deps);
+        const project = requireRememberedProject(projects, projectId2);
+        if (!project.available)
+          throw new ProjectError("invalid", project.error ?? "project configuration is invalid");
+        const name = parts[3];
+        if (method === "PUT") {
+          const body = await readBody(req);
+          if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || typeof body.value !== "string")
+            throw new HttpError(400, 'request body must contain only a string "value"');
+          (deps.setProjectSecret ?? setProjectSecret)(projectId2, name, body.value);
+        } else
+          (deps.deleteProjectSecret ?? deleteProjectSecret)(projectId2, name);
+        return json(res, 200, { ok: true });
+      }
       if (parts.length === 3 && parts[2] === "nickname" && method === "PATCH") {
         requireMutationAllowed(deps);
         const body = await readBody(req);
@@ -5369,7 +5533,9 @@ async function handleApi(req, res, url, parts, deps) {
         const project = projects.details(projectId2);
         const services = registry.list(projectId2);
         const logs = services.flatMap((service) => store.logs(service.key, 100)).sort((a, b) => a.ts - b.ts);
-        return json(res, 200, { report: diagnosticReport(project, services, logs, deps.version, [deps.controlToken]) });
+        const names = (deps.listProjectSecrets ?? listProjectSecrets)(projectId2);
+        const secretValues = Object.values((deps.resolveProjectSecrets ?? resolveProjectSecrets)(projectId2, names));
+        return json(res, 200, { report: diagnosticReport(project, services, logs, deps.version, [deps.controlToken, ...secretValues]) });
       }
       if (parts.length === 4 && parts[2] === "profiles" && method === "POST") {
         requireMutationAllowed(deps);
@@ -5466,6 +5632,16 @@ async function handleApi(req, res, url, parts, deps) {
       return json(res, 404, { error: `unknown service "${reference}"` });
     const { key, service: svc } = resolved;
     const sub = parts[2];
+    if (sub === "response" && method === "GET") {
+      const record = store.requests(key, 5000).find((request) => request.id === url.searchParams.get("requestId"));
+      if (!record)
+        throw new HttpError(404, "Recorded request is no longer available");
+      const captured = record.responseBodyId ? store.responseBodies.get(record.responseBodyId, key) : undefined;
+      if (!captured)
+        throw new HttpError(404, "Full response is no longer cached. Make a new request through the LocalDeck URL. The cache holds up to 64 MiB and resets when the daemon restarts.");
+      res.setHeader("cache-control", "no-store");
+      return json(res, 200, captured);
+    }
     if (sub === "replay" && method === "POST") {
       requireMutationAllowed(deps);
       const body = await readBody(req);
@@ -5483,6 +5659,15 @@ async function handleApi(req, res, url, parts, deps) {
     }
     if (!sub && method === "GET")
       return json(res, 200, svc);
+    if ((sub === "logs" || sub === "requests") && method === "DELETE") {
+      requireMutationAllowed(deps);
+      return json(res, 200, await store.clearHistory(key, sub));
+    }
+    if ((sub === "logs" || sub === "requests") && method === "GET") {
+      const boundary = store.historyBoundary(key, sub);
+      if (boundary)
+        res.setHeader("x-localdeck-history-boundary", boundary);
+    }
     if (sub === "logs" && method === "GET")
       return json(res, 200, store.logs(key, readLimit(url)));
     if (sub === "requests" && method === "GET")
@@ -5537,17 +5722,17 @@ function serveStatic(pathname, res, dir) {
     res.end("<h1>LocalDeck daemon</h1><p>Dashboard not built. Run <code>bun run build</code> in the repo. API is at <a href=/api/services>/api/services</a>.</p>");
     return;
   }
-  let file = path6.join(dir, path6.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
+  let file = path7.join(dir, path7.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
   if (!file.startsWith(dir))
-    file = path6.join(dir, "index.html");
-  if (!fs5.existsSync(file) || fs5.statSync(file).isDirectory())
-    file = path6.join(dir, "index.html");
-  const hashedAsset = path6.dirname(file) === path6.join(dir, "assets") && /-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/i.test(path6.basename(file));
+    file = path7.join(dir, "index.html");
+  if (!fs6.existsSync(file) || fs6.statSync(file).isDirectory())
+    file = path7.join(dir, "index.html");
+  const hashedAsset = path7.dirname(file) === path7.join(dir, "assets") && /-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/i.test(path7.basename(file));
   res.writeHead(200, {
-    "content-type": MIME[path6.extname(file)] ?? "application/octet-stream",
+    "content-type": MIME[path7.extname(file)] ?? "application/octet-stream",
     "cache-control": hashedAsset ? "public, max-age=31536000, immutable" : "no-cache"
   });
-  fs5.createReadStream(file).pipe(res);
+  fs6.createReadStream(file).pipe(res);
 }
 function handleAttach(ws, deps) {
   const { registry, store } = deps;
@@ -5758,7 +5943,7 @@ function buildRegistration(message, deps) {
   if (command.serviceType && command.serviceType !== "http" && (message.upstreamPort !== command.upstream || message.stablePort !== undefined)) {
     throw new Error("database registration must use its configured published upstream port");
   }
-  const cwd = command.cwd ? path6.resolve(project.directory, command.cwd) : project.directory;
+  const cwd = command.cwd ? path7.resolve(project.directory, command.cwd) : project.directory;
   requireDirectory(cwd);
   return {
     key: serviceKey(project.id, command.name),
@@ -5778,7 +5963,7 @@ function buildRegistration(message, deps) {
 }
 function requireDirectory(cwd) {
   try {
-    if (!fs5.statSync(cwd).isDirectory())
+    if (!fs6.statSync(cwd).isDirectory())
       throw new Error("not a directory");
   } catch {
     throw new Error(`working directory does not exist or is not a directory: ${cwd}`);
@@ -6038,7 +6223,7 @@ class Registry {
           res.writeHead(503).end("LocalDeck: service stopped");
           return;
         }
-        proxyRequest(req, res, t, { onRequest: (r) => this.store.request(r) });
+        proxyRequest(req, res, t, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
       });
       entry.sockets = new Set;
       entry.server.on("connection", (socket) => {
@@ -6049,7 +6234,7 @@ class Registry {
         const t = this.target(key);
         if (!t)
           return socket.destroy();
-        proxyUpgrade(req, socket, head, t, { onRequest: (r) => this.store.request(r) });
+        proxyUpgrade(req, socket, head, t, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
       });
       await new Promise((resolve, reject) => {
         entry.server.once("error", reject);
@@ -6243,8 +6428,86 @@ class Registry {
 }
 
 // ../daemon/src/store.ts
-import fs6 from "node:fs";
-import path7 from "node:path";
+import fs7 from "node:fs";
+
+// ../daemon/src/history.ts
+function isAfterHistoryBoundary(id, boundary) {
+  if (id.startsWith("legacy-"))
+    return false;
+  const [started, sequence] = id.split("-").map((value) => Number.parseInt(value, 36));
+  const [boundaryStarted, boundarySequence] = boundary.split("-").map((value) => Number.parseInt(value, 36));
+  return started > boundaryStarted || started === boundaryStarted && sequence > boundarySequence;
+}
+
+// ../daemon/src/response-bodies.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+var RESPONSE_CACHE_BYTES = 64 * 1024 * 1024;
+var MAX_CAPTURES = 5000;
+
+class ResponseBodies {
+  capacity;
+  entries = new Map;
+  bytes = 0;
+  constructor(capacity = RESPONSE_CACHE_BYTES) {
+    this.capacity = capacity;
+  }
+  start(service) {
+    const id = randomUUID2();
+    while (this.entries.size >= MAX_CAPTURES)
+      this.remove(this.entries.keys().next().value);
+    this.entries.set(id, { service, body: new BodyCapture(this.capacity), bytes: 0, finished: false, complete: false });
+    return {
+      id,
+      append: (chunk) => {
+        const entry = this.entries.get(id);
+        if (!entry || entry.finished)
+          return;
+        if (entry.bytes + chunk.length > this.capacity) {
+          this.remove(id);
+          return;
+        }
+        while (this.bytes + chunk.length > this.capacity) {
+          const oldest = this.entries.keys().next().value;
+          this.remove(oldest);
+          if (oldest === id)
+            return;
+        }
+        entry.body.append(chunk);
+        entry.bytes += chunk.length;
+        this.bytes += chunk.length;
+      },
+      finish: (complete, encoding) => {
+        const entry = this.entries.get(id);
+        if (entry) {
+          entry.finished = true;
+          entry.complete = complete;
+          entry.encoding = encoding;
+        }
+      }
+    };
+  }
+  get(id, service) {
+    const entry = this.entries.get(id);
+    if (!entry?.finished || entry.service !== service)
+      return;
+    return entry.body.snapshot(entry.complete, entry.encoding);
+  }
+  clear(service) {
+    for (const [id, entry] of this.entries)
+      if (!service || entry.service === service)
+        this.remove(id);
+  }
+  remove(id) {
+    const entry = this.entries.get(id);
+    if (entry) {
+      this.bytes -= entry.bytes;
+      this.entries.delete(id);
+    }
+  }
+}
+
+// ../daemon/src/store.ts
+import path8 from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { finished } from "node:stream/promises";
@@ -6288,6 +6551,7 @@ function emptyStats() {
 }
 
 class Store extends EventEmitter {
+  responseBodies = new ResponseBodies;
   buckets = new Map;
   logsDir;
   daemonStartedAt;
@@ -6302,12 +6566,12 @@ class Store extends EventEmitter {
     this.logsDir = options.logsDir ?? LOGS_DIR;
     this.daemonStartedAt = options.daemonStartedAt ?? Date.now();
     this.closeAfterMs = options.closeAfterMs ?? DEFAULT_CLOSE_AFTER_MS;
-    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs6.createWriteStream(file, streamOptions));
+    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs7.createWriteStream(file, streamOptions));
     this.maxFileBytes = Math.max(1, options.maxFileBytes ?? 5 * 1024 * 1024);
     if (options.logsDir === undefined)
       ensureDirs();
     else
-      fs6.mkdirSync(this.logsDir, { recursive: true });
+      fs7.mkdirSync(this.logsDir, { recursive: true });
   }
   nextId() {
     return `${this.daemonStartedAt.toString(36)}-${(++this.sequence).toString(36)}`;
@@ -6318,19 +6582,21 @@ class Store extends EventEmitter {
   }
   historyFile(service, type) {
     const suffix = type === "log" ? "log.jsonl" : "requests.jsonl";
-    return path7.join(this.logsDir, `${encodeURIComponent(service)}.${suffix}`);
+    return path8.join(this.logsDir, `${encodeURIComponent(service)}.${suffix}`);
   }
   legacyHistoryFile(service, type) {
     const safe = service.replace(/[^a-z0-9_-]/gi, "_");
     const suffix = type === "log" ? "log.jsonl" : "requests.jsonl";
-    return path7.join(this.logsDir, `${safe}.${suffix}`);
+    return path8.join(this.logsDir, `${safe}.${suffix}`);
   }
   loadHistory(file, type, service, ring, legacyService, budget = this.maxFileBytes) {
+    const marker2 = `${this.historyFile(service, type)}.cleared`;
+    const boundary = fs7.existsSync(marker2) ? fs7.readFileSync(marker2, "utf8") : undefined;
     let fd;
     let size;
     try {
-      fd = fs6.openSync(file, "r");
-      size = fs6.fstatSync(fd).size;
+      fd = fs7.openSync(file, "r");
+      size = fs7.fstatSync(fd).size;
     } catch (error) {
       if (error.code === "ENOENT")
         return 0;
@@ -6341,9 +6607,9 @@ class Store extends EventEmitter {
     const bytes = Buffer.alloc(count);
     try {
       if (count)
-        fs6.readSync(fd, bytes, 0, count, start);
+        fs7.readSync(fd, bytes, 0, count, start);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
     let lines = bytes.toString("binary").split(`
 `);
@@ -6363,7 +6629,8 @@ class Store extends EventEmitter {
             const input = parsed;
             if (input.service === service || input.service === legacyService) {
               const id = typeof input.id === "string" ? input.id : this.compatibilityId(type, service, offset, serialized);
-              ring.push({ ...input, service, id });
+              if (!boundary || isAfterHistoryBoundary(id, boundary))
+                ring.push({ ...input, service, id });
             }
           }
         } catch {}
@@ -6405,14 +6672,14 @@ class Store extends EventEmitter {
       const rotatedReq = `${reqFile}.1`;
       const logCurrentSize = (() => {
         try {
-          return fs6.statSync(logFile).size;
+          return fs7.statSync(logFile).size;
         } catch {
           return 0;
         }
       })();
       const reqCurrentSize = (() => {
         try {
-          return fs6.statSync(reqFile).size;
+          return fs7.statSync(reqFile).size;
         } catch {
           return 0;
         }
@@ -6479,6 +6746,42 @@ class Store extends EventEmitter {
   requests(service, limit = 200) {
     return this.bucket(service).requests.last(limit);
   }
+  historyBoundary(service, kind) {
+    const marker2 = `${this.historyFile(service, kind === "logs" ? "log" : "request")}.cleared`;
+    return fs7.existsSync(marker2) ? fs7.readFileSync(marker2, "utf8") : undefined;
+  }
+  async clearHistory(service, kind) {
+    if (this.closing)
+      throw new Error("History is unavailable during shutdown");
+    const bucket = this.bucket(service);
+    const state = kind === "logs" ? bucket.logFile : bucket.reqFile;
+    const beforeId = this.nextId();
+    const marker2 = `${state.file}.cleared`;
+    fs7.writeFileSync(`${marker2}.tmp`, beforeId, { mode: 384 });
+    fs7.renameSync(`${marker2}.tmp`, marker2);
+    bucket[kind].clear();
+    if (kind === "requests")
+      this.responseBodies.clear(service);
+    const operation = state.queue.then(async () => {
+      await this.closeStream(state.stream);
+      fs7.writeFileSync(state.file, "", { mode: 384 });
+      fs7.rmSync(`${state.file}.1`, { force: true });
+      state.bytes = 0;
+      state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
+      state.disabled = false;
+      state.stream.on("error", () => {
+        state.disabled = true;
+        this.reportPersistenceFailure(service, bucket, "history");
+      });
+    });
+    state.queue = operation.catch(() => {
+      state.disabled = true;
+      this.reportPersistenceFailure(service, bucket, "history clear");
+    });
+    const event = this.emitEvent({ type: "history:cleared", service, kind, beforeId });
+    await operation;
+    return event;
+  }
   emitEvent(ev) {
     const event = { ...ev, eventId: this.nextId() };
     this.emit("event", event);
@@ -6487,6 +6790,7 @@ class Store extends EventEmitter {
   close() {
     if (!this.closePromise) {
       this.closing = true;
+      this.responseBodies.clear();
       const buckets = [...this.buckets.values()];
       this.closePromise = (async () => {
         const states = buckets.flatMap((bucket) => [bucket.logFile, bucket.reqFile]);
@@ -6548,12 +6852,12 @@ class Store extends EventEmitter {
       } });
     }
     try {
-      if (fs6.existsSync(file))
-        fs6.chmodSync(file, 384);
+      if (fs7.existsSync(file))
+        fs7.chmodSync(file, 384);
     } catch {}
     const state = { stream, file, bytes: (() => {
       try {
-        return fs6.statSync(file).size;
+        return fs7.statSync(file).size;
       } catch {
         return 0;
       }
@@ -6627,8 +6931,8 @@ class Store extends EventEmitter {
     }
     const rotated = `${state.file}.1`;
     try {
-      fs6.rmSync(rotated, { force: true });
-      fs6.renameSync(state.file, rotated);
+      fs7.rmSync(rotated, { force: true });
+      fs7.renameSync(state.file, rotated);
     } catch {
       state.disabled = true;
       this.reportPersistenceFailure(service, bucket, "history rotation");
@@ -6636,7 +6940,7 @@ class Store extends EventEmitter {
     }
     state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
     try {
-      fs6.chmodSync(state.file, 384);
+      fs7.chmodSync(state.file, 384);
     } catch {}
     state.bytes = 0;
     state.stream.on("error", () => {
@@ -6682,8 +6986,8 @@ function settlesWithin2(promise, timeoutMs) {
 
 // ../daemon/src/supervisor.ts
 import { spawn as spawn3 } from "node:child_process";
-import path8 from "node:path";
-import fs7 from "node:fs";
+import path9 from "node:path";
+import fs8 from "node:fs";
 
 // ../daemon/src/startup-guidance.ts
 function startupGuidance(message) {
@@ -6737,7 +7041,7 @@ async function waitForReadiness(command, getService, options = {}) {
     await delay2(Math.min(command.ready.intervalMs, afterProbe), command.name, options.signal);
   }
 }
-function probeHttp(service, path8, expectedStatus, remainingMs, signal) {
+function probeHttp(service, path9, expectedStatus, remainingMs, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted)
       return reject(new Error(`${service.name} readiness cancelled`));
@@ -6755,7 +7059,7 @@ function probeHttp(service, path8, expectedStatus, remainingMs, signal) {
     const request = http7.request({
       host: service.upstreamHost,
       port: service.upstreamPort,
-      path: path8,
+      path: path9,
       method: "GET",
       timeout: Math.max(1, Math.min(remainingMs, 2000))
     }, (response) => {
@@ -6859,6 +7163,81 @@ function assertNotCancelled(name, signal) {
     throw new Error(`${name} readiness cancelled`);
 }
 
+// ../daemon/src/secret-output.ts
+import { Transform } from "node:stream";
+import { StringDecoder as StringDecoder2 } from "node:string_decoder";
+import { stripVTControlCharacters } from "node:util";
+function secretOutput(values) {
+  const decoder = new StringDecoder2("utf8");
+  let pending = "";
+  let control = "text";
+  function normalize2(text) {
+    if (!values.size)
+      return text;
+    let result = "";
+    for (const character of text) {
+      if (control === "text") {
+        if (character === "\x1B")
+          control = "escape";
+        else if (character === "›")
+          control = "csi";
+        else
+          result += character;
+      } else if (control === "escape") {
+        control = character === "[" ? "csi" : character === "]" ? "osc" : character >= " " && character <= "/" ? "intermediate" : "text";
+      } else if (control === "intermediate") {
+        if (character >= "0" && character <= "~")
+          control = "text";
+      } else if (control === "csi") {
+        if (character >= "@" && character <= "~")
+          control = "text";
+      } else if (control === "osc") {
+        if (character === "\x07")
+          control = "text";
+        else if (character === "\x1B")
+          control = "osc-escape";
+      } else {
+        control = character === "\\" || character === "\x07" ? "text" : character === "\x1B" ? "osc-escape" : "osc";
+      }
+    }
+    return result;
+  }
+  function consume(final) {
+    const secrets = [...values].map(stripVTControlCharacters).filter(Boolean).sort((a, b) => b.length - a.length);
+    if (!secrets.length) {
+      const output2 = pending;
+      pending = "";
+      return output2;
+    }
+    let output = "";
+    let index = 0;
+    while (index < pending.length) {
+      const remaining = pending.slice(index);
+      if (!final && secrets.some((value) => value.length > remaining.length && value.startsWith(remaining)))
+        break;
+      const match = secrets.find((value) => pending.startsWith(value, index));
+      if (match) {
+        output += "[REDACTED]";
+        index += match.length;
+      } else {
+        output += pending[index++];
+      }
+    }
+    pending = pending.slice(index);
+    return output;
+  }
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      pending += normalize2(decoder.write(chunk));
+      callback(null, consume(false));
+    },
+    flush(callback) {
+      pending += normalize2(decoder.end());
+      callback(null, consume(true));
+    }
+  });
+}
+
 // ../daemon/src/supervisor.ts
 var DEFAULT_FORCE_AFTER_MS = 5000;
 var DEFAULT_DETECT_AFTER_MS = 300;
@@ -6878,8 +7257,10 @@ class ProcessSupervisor {
   killTree;
   shareLifecycle;
   allocatePort;
+  resolveSecrets;
   upstreamReservations = new Set;
   retries = new Map;
+  redactionValues = new Set;
   retryDelayMs;
   shuttingDown = false;
   shutdownPromise;
@@ -6894,6 +7275,7 @@ class ProcessSupervisor {
     this.killTree = options.killProcessTree ?? killProcessTree;
     this.shareLifecycle = options.shareLifecycle;
     this.allocatePort = options.getFreePort ?? getFreePort;
+    this.resolveSecrets = options.resolveProjectSecrets ?? resolveProjectSecrets;
   }
   start(projectId2, serviceName2) {
     const name = serviceName2.toLowerCase();
@@ -6952,11 +7334,11 @@ class ProcessSupervisor {
           return started;
         const hasDependents = project.commands.some((candidate) => candidate.after.includes(command.name));
         if (command.ready.type === "tcp" && !hasDependents) {
-          const cwd2 = command.cwd ? path8.resolve(project.directory, command.cwd) : project.directory;
+          const cwd2 = command.cwd ? path9.resolve(project.directory, command.cwd) : project.directory;
           this.verifyReadiness(command, key, cwd2);
           return started;
         }
-        const cwd = command.cwd ? path8.resolve(project.directory, command.cwd) : project.directory;
+        const cwd = command.cwd ? path9.resolve(project.directory, command.cwd) : project.directory;
         return this.verifyReadiness(command, key, cwd, started);
       })();
       attempts.set(command.name, attempt);
@@ -6981,7 +7363,14 @@ class ProcessSupervisor {
     this.setReadiness(key, "checking", command.ready.type === "tcp" ? "Waiting for the service to listen" : "Running configured readiness check");
     this.store.log({ ts: Date.now(), service: key, stream: "system", line: `LocalDeck: checking readiness for ${command.name}` });
     try {
-      await waitForReadiness(command, () => isCurrent() ? generation : undefined, { cwd, env: this.expandCommandEnv(command.env, command.after, generation.projectId) });
+      let commandEnv = processGeneration?.commandEnv;
+      if (!commandEnv && generation) {
+        const secretEnv = this.resolveSecrets(generation.projectId, command.secrets ?? []);
+        for (const value of Object.values(secretEnv))
+          this.redactionValues.add(value);
+        commandEnv = { ...this.expandCommandEnv(command.env, command.after, generation.projectId), ...secretEnv };
+      }
+      await waitForReadiness(command, () => isCurrent() ? generation : undefined, { cwd, env: commandEnv });
       if (!isCurrent() || generation.status === "stopped" || generation.status === "stopping")
         return failure(key, command.name, "readiness cancelled");
       const message = command.ready.type === "tcp" ? "Listening on its upstream port" : "Configured readiness check passed";
@@ -7095,13 +7484,21 @@ class ProcessSupervisor {
     const project = this.projects.details(projectId2);
     if (!project.available)
       throw new ProjectError("invalid", project.error);
-    const cwd = command.cwd ? path8.resolve(project.directory, command.cwd) : project.directory;
+    const cwd = command.cwd ? path9.resolve(project.directory, command.cwd) : project.directory;
     try {
-      if (!fs7.statSync(cwd).isDirectory())
+      if (!fs8.statSync(cwd).isDirectory())
         throw new Error("not a directory");
     } catch {
       throw new ProjectError("invalid", `configured working directory does not exist or is not a directory: ${cwd}`);
     }
+    let secretEnv;
+    try {
+      secretEnv = this.resolveSecrets(projectId2, command.secrets ?? []);
+      for (const value of Object.values(secretEnv))
+        this.redactionValues.add(value);
+    } catch (error) {
+      return failure(key, name, errorMessage2(error));
+    }
     let upstreamPort;
     try {
       upstreamPort = command.upstream ?? await this.reserveAutomaticUpstream();
@@ -7111,7 +7508,7 @@ class ProcessSupervisor {
     const reservedUpstreamPort = command.upstream === undefined ? upstreamPort : undefined;
     let commandEnv;
     try {
-      commandEnv = this.expandCommandEnv(command.env, command.after, projectId2);
+      commandEnv = { ...this.expandCommandEnv(command.env, command.after, projectId2), ...secretEnv };
     } catch (error) {
       this.releaseAutomaticUpstream(reservedUpstreamPort);
       return failure(key, name, errorMessage2(error));
@@ -7170,7 +7567,8 @@ class ProcessSupervisor {
       completion: new Promise((resolve) => {
         complete = resolve;
       }),
-      reservedUpstreamPort
+      reservedUpstreamPort,
+      commandEnv
     };
     this.active.set(key, managed);
     let finalized = false;
@@ -7209,7 +7607,7 @@ class ProcessSupervisor {
           ts: Date.now(),
           service: key,
           stream: "system",
-          line: `process exited (${launchError2 ? launchError2.message : signal ?? `code ${code}`})`
+          line: redactDiagnostic(`process exited (${launchError2 ? launchError2.message : signal ?? `code ${code}`})`, [...this.redactionValues])
         });
         if (retainForCleanup) {
           const current = this.registry.get(key);
@@ -7232,10 +7630,10 @@ class ProcessSupervisor {
         }
       }
     };
-    streamLines(child.stdout, (line) => {
+    streamLines(child.stdout.pipe(secretOutput(this.redactionValues)), (line) => {
       this.store.log({ ts: Date.now(), service: key, stream: "stdout", line: stripAnsi(line) });
     });
-    streamLines(child.stderr, (line) => {
+    streamLines(child.stderr.pipe(secretOutput(this.redactionValues)), (line) => {
       const clean = stripAnsi(line);
       managed.stderr.push(clean);
       if (managed.stderr.length > STDERR_SUMMARY_LINES)
@@ -7315,7 +7713,7 @@ class ProcessSupervisor {
           else {
             const command = this.projects.resolve(projectId2, name);
             const project = this.projects.details(projectId2);
-            const cwd = command.cwd ? path8.resolve(project.directory, command.cwd) : project.directory;
+            const cwd = command.cwd ? path9.resolve(project.directory, command.cwd) : project.directory;
             this.verifyReadiness(command, key, cwd);
           }
           return result;
@@ -7591,7 +7989,7 @@ async function waitForProcessGroupExit(groupId, timeoutMs) {
   return true;
 }
 // ../daemon/package.json
-var version = "1.0.3";
+var version = "1.1.0";
 
 // ../daemon/src/index.ts
 var VERSION = version;
@@ -7607,8 +8005,8 @@ async function startDaemon(opts = {}) {
     writePrivateState: writePrivateJson,
     ...opts.dependencies
   };
-  const stateFile = opts.homeDir ? path9.join(opts.homeDir, "daemon.json") : STATE_FILE;
-  const projectsFile = opts.homeDir ? path9.join(opts.homeDir, "projects.json") : PROJECTS_FILE;
+  const stateFile = opts.homeDir ? path10.join(opts.homeDir, "daemon.json") : STATE_FILE;
+  const projectsFile = opts.homeDir ? path10.join(opts.homeDir, "projects.json") : PROJECTS_FILE;
   const apiPort = opts.apiPort ?? DEFAULT_API_PORT;
   const store = dependencies.createStore();
   const registry = dependencies.createRegistry(store, apiPort);
@@ -7668,16 +8066,16 @@ async function startDaemon(opts = {}) {
         if (stateCleanup === "failed-write") {
           if (!stateWriteAttempted)
             return;
-          fs8.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
+          fs9.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
           if (priorState)
             restorePrivateState(stateFile, priorState.contents, priorState.mode);
           else
-            fs8.rmSync(stateFile, { force: true });
+            fs9.rmSync(stateFile, { force: true });
           return;
         }
         const state = readJson(stateFile, null);
         if (state?.pid === process.pid)
-          fs8.unlinkSync(stateFile);
+          fs9.unlinkSync(stateFile);
       }));
       return errors;
     })();
@@ -7693,15 +8091,15 @@ async function startDaemon(opts = {}) {
     stopPromise.then(resolveStopped, rejectStopped);
     return stopPromise;
   };
-  server = dependencies.createApiServer({ registry, store, shares, projects, supervisor, controlToken, isShuttingDown: () => shuttingDown, trackAttachOperation: attachOperations.track, dashboardDir: opts.dashboardDir, allowedBrowserOrigins: opts.allowedBrowserOrigins, version: VERSION, startedAt, shutdown: stop });
+  server = dependencies.createApiServer({ registry, store, shares, projects, supervisor, controlToken, isShuttingDown: () => shuttingDown, trackAttachOperation: attachOperations.track, dashboardDir: opts.dashboardDir, allowedBrowserOrigins: opts.allowedBrowserOrigins, version: VERSION, startedAt, shutdown: stop, listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets });
   try {
     await new Promise((resolve, reject) => {
       server.once("error", reject);
       server.listen(apiPort, "127.0.0.1", resolve);
     });
-    if (fs8.existsSync(stateFile)) {
-      const stat = fs8.statSync(stateFile);
-      priorState = { contents: fs8.readFileSync(stateFile), mode: stat.mode & 511 };
+    if (fs9.existsSync(stateFile)) {
+      const stat = fs9.statSync(stateFile);
+      priorState = { contents: fs9.readFileSync(stateFile), mode: stat.mode & 511 };
     }
     stateWriteAttempted = true;
     dependencies.writePrivateState(stateFile, {
@@ -7722,9 +8120,9 @@ async function startDaemon(opts = {}) {
 }
 function restorePrivateState(file, contents, mode) {
   const temporary = `${file}.${process.pid}.restore.tmp`;
-  fs8.writeFileSync(temporary, contents, { mode });
-  fs8.chmodSync(temporary, mode);
-  fs8.renameSync(temporary, file);
+  fs9.writeFileSync(temporary, contents, { mode });
+  fs9.chmodSync(temporary, mode);
+  fs9.renameSync(temporary, file);
 }
 function toError3(error) {
   return error instanceof Error ? error : new Error(String(error));
@@ -7759,24 +8157,24 @@ async function findDaemon() {
 
 // src/client.ts
 import { spawn as spawn4, spawnSync } from "node:child_process";
-import fs9 from "node:fs";
-import path10 from "node:path";
+import fs10 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath } from "node:url";
 function dashboardDir() {
-  const here = path10.dirname(fileURLToPath(import.meta.url));
+  const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path10.resolve(here, "../dashboard"),
-    path10.resolve(here, "../../dashboard/dist")
+    path11.resolve(here, "../dashboard"),
+    path11.resolve(here, "../../dashboard/dist")
   ];
-  return candidates.find((d) => fs9.existsSync(path10.join(d, "index.html")));
+  return candidates.find((d) => fs10.existsSync(path11.join(d, "index.html")));
 }
 function daemonCommand() {
   const entry = process.argv[1];
   const runningUnderBun = Boolean(process.versions.bun);
   if (runningUnderBun) {
-    const dist = path10.resolve(path10.dirname(fileURLToPath(import.meta.url)), "../dist/index.js");
+    const dist = path11.resolve(path11.dirname(fileURLToPath(import.meta.url)), "../dist/index.js");
     const hasNode = spawnSync("node", ["--version"], { stdio: "ignore" }).status === 0;
-    if (fs9.existsSync(dist) && hasNode)
+    if (fs10.existsSync(dist) && hasNode)
       return ["node", [dist, "daemon", "run"]];
     console.warn("LocalDeck: starting daemon under Bun — WebSocket proxying (HMR) will not work. Run `bun run build` and make sure `node` is on PATH.");
   }
@@ -7788,8 +8186,8 @@ async function ensureDaemon() {
   const running = await findDaemon();
   if (running)
     return running;
-  fs9.mkdirSync(path10.dirname(DAEMON_LOG), { recursive: true });
-  const out = fs9.openSync(DAEMON_LOG, "a");
+  fs10.mkdirSync(path11.dirname(DAEMON_LOG), { recursive: true });
+  const out = fs10.openSync(DAEMON_LOG, "a");
   const [cmd, args] = daemonCommand();
   const child = spawn4(cmd, args, { detached: true, stdio: ["ignore", out, out], env: process.env });
   child.unref();
@@ -7858,4 +8256,4 @@ class Api {
   shutdown = () => this.call("POST", "/api/shutdown");
 }
 
-export { __toESM, __commonJS, __export, __require, wrapper_default, startForwarder, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, findProjectFile, loadProject, loadProjectFile, shellCommand, isPortFree, getFreePort, serviceKey, processTree, listeningPorts, chooseUpstream, connectHost, streamLines, killProcessTree, stripAnsi, redactDiagnostic, environmentValues, startupGuidance, startupLayers, waitForReadiness, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };
+export { __toESM, __commonJS, __export, __require, wrapper_default, startForwarder, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, findProjectFile, loadProject, loadProjectFile, shellCommand, isPortFree, getFreePort, serviceKey, processTree, listeningPorts, chooseUpstream, connectHost, streamLines, killProcessTree, stripAnsi, redactDiagnostic, environmentValues, listProjectSecrets, resolveProjectSecrets, startupGuidance, startupLayers, waitForReadiness, secretOutput, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };