localdeck 1.0.3 → 1.1.0

package/dist/index.js

@@ -17,6 +17,8 @@ import {
   loadProject,
   loadProjectFile,
   processTree,
+  resolveProjectSecrets,
+  secretOutput,
   serviceKey,
   shellCommand,
   startDaemon,
@@ -27,7 +29,7 @@ import {
   stripAnsi,
   waitForReadiness,
   wrapper_default
-} from "./index-3qpxpxwq.js";
+} from "./index-n4sq4z00.js";
 
 // src/index.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -119,15 +121,20 @@ async function startService(opts, overrides = {}) {
     throw new Error(`working directory does not exist or is not a directory: ${cwd}`);
   }
   const daemon = await dependencies.ensureDaemon();
-  const upstreamPort = opts.upstreamPort ?? await dependencies.getFreePort();
-  const paint = opts.color ?? c.cyan;
-  const tag = opts.prefix ? paint(`[${opts.name}] `) : "";
   const project = opts.project ?? {
     id: "standalone",
     name: "standalone",
     slug: "standalone"
   };
-  const commandEnv = await expandRunEnvironment(opts.env, opts.after ?? [], project.id, daemon.apiPort, dependencies.fetch);
+  let secretEnv = {};
+  const resolveSecrets = dependencies.resolveProjectSecrets ?? resolveProjectSecrets;
+  if (opts.secrets?.length && project.id !== "standalone")
+    secretEnv = resolveSecrets(project.id, opts.secrets);
+  const upstreamPort = opts.upstreamPort ?? await dependencies.getFreePort();
+  const paint = opts.color ?? c.cyan;
+  const tag = opts.prefix ? paint(`[${opts.name}] `) : "";
+  let commandEnv = await expandRunEnvironment(opts.env, opts.after ?? [], project.id, daemon.apiPort, dependencies.fetch);
+  commandEnv = { ...commandEnv, ...secretEnv };
   const ws = dependencies.createWebSocket(`ws://127.0.0.1:${daemon.apiPort}/api/attach`, {
     headers: { authorization: `Bearer ${daemon.controlToken}` }
   });
@@ -160,14 +167,16 @@ async function startService(opts, overrides = {}) {
   });
   const argv = opts.command.map((a) => a.replaceAll("{port}", String(upstreamPort)));
   const database = service.serviceType !== undefined && service.serviceType !== "http";
-  const env = {
+  let env = {
     ...process.env,
     ...commandEnv,
+    ...secretEnv,
     PORT: String(upstreamPort),
     LOCALDECK_PORT: String(service.stablePort),
     LOCALDECK_SERVICE: service.name,
     ...database ? {} : { LOCALDECK_URL: `http://localhost:${service.stablePort}` }
   };
+  const redactionValues = new Set(Object.values(secretEnv));
   if (database) {
     console.log(`${tag}${c.bold("LocalDeck")} ${c.dim("›")} ${paint(service.name)} ${c.dim("→")} ${c.green(`database localhost:${service.upstreamPort}`)} ${c.dim("(published port · no HTTP proxy)")}`);
   } else {
@@ -177,7 +186,8 @@ async function startService(opts, overrides = {}) {
   const posix = process.platform !== "win32";
   let child;
   const pipe = (stream, name, out) => {
-    stream.on("data", (chunk) => {
+    const output = redactionValues.size ? stream.pipe(secretOutput(redactionValues)) : stream;
+    output.on("data", (chunk) => {
       if (opts.prefix) {
         const text = stripAnsi(chunk.toString());
         recentOutput = (recentOutput + text).slice(-16000);
@@ -185,7 +195,7 @@ async function startService(opts, overrides = {}) {
       } else
         out.write(chunk);
     });
-    streamLines(stream, (line) => {
+    streamLines(output, (line) => {
       for (const part of splitAttachLogLine(stripAnsi(line)))
         send({ type: "log", stream: name, line: part });
     });
@@ -294,6 +304,13 @@ async function startService(opts, overrides = {}) {
       console.error(`${tag}${c.yellow("LocalDeck: lost connection to daemon; the stable port is no longer proxied. Process keeps running.")}`);
   });
   function launch() {
+    if (retryAttempts > 0 && opts.secrets?.length && project.id !== "standalone") {
+      secretEnv = resolveSecrets(project.id, opts.secrets);
+      for (const value of Object.values(secretEnv))
+        redactionValues.add(value);
+      commandEnv = { ...commandEnv, ...secretEnv };
+      env = { ...process.env, ...commandEnv, PORT: String(upstreamPort), LOCALDECK_PORT: String(service.stablePort), LOCALDECK_SERVICE: service.name, ...database ? {} : { LOCALDECK_URL: `http://localhost:${service.stablePort}` } };
+    }
     leaderExit = undefined;
     cleanupPromise = undefined;
     finalizing = false;
@@ -880,13 +897,13 @@ async function main(argv, overrides = {}) {
     case "--update":
       if (rest.length)
         throw new Error("Usage: localdeck --update");
-      return (await import("./update-2f1pgdst.js")).updateLocalDeck();
+      return (await import("./update-gj01sqte.js")).updateLocalDeck();
     case "up":
       return cmdUp(rest, dependencies);
     case "init":
       return cmdInit(rest, dependencies);
     case "mcp":
-      return (await import("./mcp-tgg2n05x.js")).runMcp(rest);
+      return (await import("./mcp-arq8ad4g.js")).runMcp(rest);
     case "doctor":
       return cmdDoctor(rest);
     case "forward":
@@ -956,6 +973,7 @@ function toRunOptions(p, project, remembered, extra = {}) {
     after: p.after,
     ready: p.ready,
     ...p.env ? { env: p.env } : {},
+    ...p.secrets ? { secrets: p.secrets } : {},
     ...p.serviceType ? { serviceType: p.serviceType } : {},
     ...extra
   };

package/dist/{mcp-tgg2n05x.js → mcp-arq8ad4g.js}

@@ -6,8 +6,10 @@ import {
   __toESM,
   ensureDaemon,
   environmentValues,
-  redactDiagnostic
-} from "./index-3qpxpxwq.js";
+  listProjectSecrets,
+  redactDiagnostic,
+  resolveProjectSecrets
+} from "./index-n4sq4z00.js";
 
 // ../../node_modules/.bun/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS((exports) => {
@@ -34008,6 +34010,8 @@ function createMcpServer(options) {
     scope(projectId);
     const details = await api2.project(projectId);
     const directories = new Set(details.directory ? [details.directory] : []);
+    const stored = options.projectSecrets ? options.projectSecrets(details.id) : /^[a-f0-9]{16}$/.test(details.id) ? resolveProjectSecrets(details.id, listProjectSecrets(details.id)) : {};
+    secrets.push(...Object.values(stored));
     for (const command of details.commands) {
       for (const [name, value] of Object.entries(command.env ?? {})) {
         if (/password|secret|token|api[_-]?key|credential/i.test(name))

package/dist/{update-2f1pgdst.js → update-gj01sqte.js}

@@ -2,7 +2,7 @@ import {
   Api,
   STATE_FILE,
   findDaemon
-} from "./index-3qpxpxwq.js";
+} from "./index-n4sq4z00.js";
 
 // src/update.ts
 import { spawn } from "node:child_process";

package/docs/configuration.md

@@ -22,7 +22,12 @@ JSON at the project root. `localdeck init` generates one from `package.json`; ed
 - `after` — optional, one service name or an array. LocalDeck starts those prerequisites first and waits until they are ready. `localdeck web` and `localdeck up frontend` automatically include transitive prerequisites.
 - `ready` — optional advanced readiness check. Without it, LocalDeck waits for its ownership-verified upstream port. Use `"/health"` for an HTTP endpoint, or one of the advanced objects below.
 - `serviceType` — `http` (default), `postgres`, `redis`, or `compose`. Database services require `upstream`, use that published port directly, and cannot set an HTTP proxy `port`. They have no browser/share links: LocalDeck does not proxy PostgreSQL or Redis traffic.
-- `env` — optional environment overrides. `PORT` and `LOCALDECK_*` are reserved. Use `{service:api:url}` or `{service:database:port}` to reference a service explicitly listed in `after`. Database port references use the actual published port; database URL references are rejected. Keep secrets in your environment, not committed config.
+- `env` — optional environment overrides. `PORT` and `LOCALDECK_*` are reserved. Use `{service:api:url}` or `{service:database:port}` to reference a service explicitly listed in `after`. Database port references use the actual published port; database URL references are rejected.
+- `secrets` — optional list of environment names whose values are managed in Project → Secrets. Names are declared here, while values are stored outside the project at `$LOCALDECK_HOME/secrets/<project-id>.json` (by default `~/.localdeck/secrets/`). Values are plaintext on this computer and never written to `.localdeck`.
+
+For example: `{ "name": "web", "run": "npm run dev", "secrets": ["CLOUDFLARE_API", "CLOUDFLARE_ID"] }`. Each machine needs its own secret values. A missing value blocks launch with instructions to add it. Saved changes apply the next time the service starts, including automatic retries; editing a value never restarts a running service.
+
+Secrets are stored in plaintext on this computer, outside your project. They are not encrypted. Anyone with access to the file can read them. Values persist across daemon restarts, updates, and reboots. File permissions restrict access where supported; they do not make the file readable only by LocalDeck.
 
 The dashboard shows each relationship as **Starts after** and lets you edit it with checkboxes—no graph terminology or manual JSON is required. Missing names, self-dependencies, and cycles are rejected before the file changes.
 

package/docs/dashboard.md

@@ -26,9 +26,11 @@ A nickname such as `platform` produces `http://platform.web.localhost:7777`. Wit
 
 Service configuration fills the available width. Edit stable and upstream ports, TCP or HTTP readiness, timing, and startup dependencies. Changes are validated and saved atomically, and apply to running services after restart. Commands, working directories, environment values, and command-based readiness remain file-edited.
 
+The Secrets button beside Settings on the project page opens a dedicated Secrets page at `/projects/<project-id>/secrets`. It lists declared names and whether each value is configured. Use Add secret, Replace, or Set value to open the editor popover; click outside or press Escape to dismiss it. Remove deletes a saved value. Password fields start empty; saved values are never shown again. Secrets are stored in plaintext on this computer, outside your project. They are not encrypted. Anyone with access to the file can read them. Changes apply when the service next starts. Secret values are per machine and must be configured separately on each machine.
+
 ## Logs
 
-Choose **Logs** or **View logs** to open that service's tab in the bottom panel. Select additional sources from the Services menu; **All selected** combines their output chronologically. Filter retained output or follow new lines.
+Choose **Logs** or **View logs** to open that service's tab in the bottom panel. Select additional sources from the Services menu; **All selected** combines their output chronologically. Filter retained output or follow new lines. Use the trash icon beside a service tab to clear that service’s logs. Clearing keeps the service running and new output continues to appear.
 
 Drag the panel's top edge to resize it, or focus the edge and use the arrow keys or Home/End. Its height is saved in the browser. The panel stays available when navigating between pages.
 
@@ -70,7 +72,9 @@ Project diagnostics include configuration, readiness errors, and recent logs. En
 
 Successful asset and development-module requests are hidden by default. Enable **Show assets & dev traffic** to include them; this preference is saved in the browser. Failed requests, page navigations, and API calls remain visible. Filtering affects the dashboard view, not capture.
 
-Choose **View requests** on a service, then expand a request row to inspect its method, path, status, timing, size, and local/share source. Details and replay responses expand directly below the selected row. Click the request again to collapse it. Service tabs and filtering are available in this view. **Replay request** sends eligible GET/HEAD requests and displays the new response body. New HTTP requests include request and response headers, request cookies, Set-Cookie values, and query parameters. Headers retain duplicate entries and are capped at 100 entries or 16 KiB per direction. These details, including cookie and authorization values, are stored in local request history. Older records cannot recover headers that were not captured. New HTTP requests also retain original request and response body previews, limited to 16 KiB per direction. Text is shown as UTF-8; binary or undecodable compressed content is shown as Base64. Complete gzip, deflate and Brotli bodies are decoded within the same preview limit. Older records cannot recover bodies that were not captured. Request inspection is also available through CLI/API/MCP. Recorded GET/HEAD replay sends a new request to the current local upstream, without copying cookies, authorization, or request bodies. It does not follow redirects and has bounded response size and duration.
+Choose **View requests** on a service, then expand a request row to inspect its method, path, status, timing, size, and local/share source. Details and replay responses expand directly below the selected row. Click the request again to collapse it. Service tabs and filtering are available in this view. The trash icon beside each service tab clears only its requests. Clears apply to connected dashboards and survive refreshes and daemon restarts. **Replay request** sends eligible GET/HEAD requests and displays the new response body. New HTTP requests include request and response headers, request cookies, Set-Cookie values, and query parameters. Headers retain duplicate entries and are capped at 100 entries or 16 KiB per direction. These details, including cookie and authorization values, are stored in local request history. Older records cannot recover headers that were not captured. New HTTP requests also retain original request and response body previews, limited to 16 KiB per direction. Text is shown as UTF-8; binary or undecodable compressed content is shown as Base64. Complete gzip, deflate and Brotli bodies are decoded within the same preview limit. Expand **Response** to load the full captured response. Full bodies use a shared 64 MiB cache, which evicts older entries as it fills and resets when the daemon restarts. The inspector identifies expired bodies and incomplete transfers. Original previews remain in saved history. Older records cannot recover bodies that were not captured. Request inspection is also available through CLI/API/MCP. Recorded GET/HEAD replay sends a new request to the current local upstream, without copying cookies, authorization, or request bodies. It does not follow redirects and has bounded response size and duration.
+
+Traffic must pass through a LocalDeck service URL to be captured. Calls directly to Wrangler at `localhost:8787`, or through Worker service bindings, bypass the proxy. Configure your frontend’s API base URL to use the API service’s LocalDeck URL.
 
 For an occupied startup port, service errors show recovery guidance with the raw output under Technical details. Vite guidance covers `strictPort` and reading `PORT`; LocalDeck does not change your application configuration or terminate unrelated listeners.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "localdeck",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "type": "module",
   "description": "Stable ports, shareable HTTPS links and request logs for your local dev servers",
   "bin": {